CVE-2020-24742High· 7.8▾ TwilightAn issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
qt >= 5.6.0, < 5.12.7qt >= 5.13.0, <= 5.13.2Upgrade past the affected range:
qt 5.12.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107590Low· 1.9Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt
CVE-2026-107472Medium· 4.3Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
CVE-2026-105946Medium· 5.3Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt
CVE-2026-107157Low· 2.0Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework
CVE-2026-96432Low· 2.1Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
CVE-2026-95620Low· 2.1Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt