CVE-2026-13326: Qt NFC Out-of-Bounds Read DOS Vulnerability

CVE-2026-13326 Overview

CVE-2026-13326 is an out-of-bounds read vulnerability in Qt NFC's language code length parsing routine. A physically proximate attacker can present a crafted Near Field Communication (NFC) tag to a vulnerable device. The malformed tag triggers the parser to read beyond allocated buffer boundaries. Successful exploitation results in denial of service or limited memory disclosure from the affected process.

The flaw is tracked under CWE-125 (Out-of-bounds Read) and requires adjacent-network proximity plus user interaction, such as scanning or tapping the tag.

Critical Impact
An attacker within NFC range can crash Qt-based applications processing NDEF records or leak small amounts of process memory through a specially crafted tag.

Affected Products

Qt Connectivity module (Qt NFC component)
Applications built with Qt NFC that parse NDEF records containing language codes
Devices using Qt-based software to read external NFC tags

Discovery Timeline

2026-09-11 - CVE-2026-13326 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13326

Vulnerability Analysis

Qt NFC parses NDEF (NFC Data Exchange Format) records to extract structured payloads such as text, URIs, and smart posters. Text records embed a status byte whose lower bits encode the length of an IANA language code that immediately follows. Qt's parsing logic reads this length field without adequately validating it against the remaining bytes in the record payload.

When an attacker supplies a language code length that exceeds the actual payload size, the parser reads memory past the end of the input buffer. The out-of-bounds read either dereferences unmapped memory, causing the process to crash, or returns adjacent heap contents to code paths that expose the value further.

The issue is fixed in the upstream Qt Connectivity repository. Technical details are available in the Qt Project Code Review.

Root Cause

The root cause is missing bounds validation on an attacker-controlled length field extracted from an untrusted NDEF text record. The parser trusts the encoded language code length instead of comparing it against the remaining bytes available in the record. This pattern is a classic [CWE-125] out-of-bounds read caused by improper input validation of a length prefix.

Attack Vector

Exploitation requires the attacker to bring an NFC transmitter, such as a programmable card or smartphone, within a few centimeters of the target device. The victim must initiate a read of the crafted tag, satisfying the user-interaction requirement. Once the malicious NDEF record is parsed, the vulnerable code path triggers the out-of-bounds read. No authentication, credentials, or network access are needed.

The vulnerability does not permit arbitrary code execution or modification of application data. Impact is limited to availability of the parsing process and confidentiality of small amounts of adjacent memory.

Detection Methods for CVE-2026-13326

Indicators of Compromise

Unexpected crashes or restarts of Qt-based applications shortly after NFC tag interactions
Segmentation faults or ASan out-of-bounds read reports originating from Qt NFC NDEF parsing functions
Anomalous NFC read events on kiosks, point-of-sale terminals, or mobile devices without corresponding business activity

Detection Strategies

Enable AddressSanitizer or equivalent memory-safety tooling in development builds to surface out-of-bounds reads in NDEF parsing during QA
Collect and centralize application crash telemetry from endpoints running Qt-based NFC readers, then alert on crash signatures pointing to Qt Connectivity symbols
Correlate NFC read events with process crash logs to identify tags that consistently trigger parser failures

Monitoring Recommendations

Monitor endpoint process crash logs for Qt Connectivity stack frames in the faulting call stack
Track NFC subsystem activity on managed mobile fleets and kiosks through mobile device management (MDM) telemetry
Review physical access controls and video surveillance around devices that perform NFC reads in public settings

How to Mitigate CVE-2026-13326

Immediate Actions Required

Inventory all internally developed and third-party applications that link against the Qt Connectivity module and use NFC functionality
Update Qt Connectivity to a version that incorporates the fix referenced in the Qt Project code review linked above
Rebuild and redistribute downstream applications that statically link Qt NFC once the patched version is in place
Restrict NFC reading to trusted tags or disable NFC on devices that do not require it for business operations

Patch Information

The upstream fix is tracked in the Qt Project Code Review for the qtconnectivity repository. Downstream distributions and application vendors that bundle Qt should backport this change and issue updated packages. Verify that shipped binaries include the corrected length validation in the NDEF text record parser before returning affected devices to production use.

Workarounds

Disable NFC on affected devices where the feature is not operationally required
Physically shield or restrict access to devices performing NFC reads to reduce opportunity for a proximate attacker
Validate NDEF records at an application-layer wrapper before passing untrusted tag data to Qt NFC APIs, rejecting records whose declared language code length exceeds the remaining payload