CVE-2026-105923

MediumCVSS 4.0/10Last modified Oct 22, 2026

Description

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

Metrics

CVSS 4.0 4.0/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green

Weakness enumeration

CWE-190CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1059265.3The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCrCVE-2026-1059272.3The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer eCVE-2026-105936.5The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_eCVE-2026-1059306.0When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar PacCVE-2026-1059312.3The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization aCVE-2026-1059322.3The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persiCVE-2026-1059332.3Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_requiCVE-2026-1059347.2The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespaceCVE-2026-1059354.9The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the fuCVE-2026-1059365.3The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions workeCVE-2026-1059378.7Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The sourcCVE-2026-1059382.3Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which req
CVE-2026-105923: Medium severity, CVSS 4.0 | Vulnix