CVE-2026-94370
Description
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Is your site exposed to CVE-2026-94370?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-94370? +
How do I check if I'm vulnerable to CVE-2026-94370? +
Related Vulnerabilities
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when …
A double free vulnerability has been identified in the ASUS System Analysis service. This vulnerability can be triggered by sending …
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if …
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: from 7.4.0 before …
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of …
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size …