There are 2 open security issues in bookworm.
1 important issue:
- CVE-2026-13326:
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
1 issue postponed or untriaged:
- CVE-2025-23050:
(needs triaging)
QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/q/qt6-connectivity.png){kind=link}