Qt 6.10.3

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. C++ C++23130 lines · 3.5K tokens
  2. Qt 6.10.395 lines · 4.2K tokens
Total225 lines · 7.7K tokens

CWE Coverage

  • 14
  • 15
  • 20
  • 22
  • 59
  • 78
  • 89
  • 91
  • 95
  • 116
  • 117
  • 125
  • 129
  • 131
  • 134
  • 190
  • 195
  • 197
  • 201
  • 208
  • 209
  • 214
  • 252
  • 287
  • 295
  • 319
  • 321
  • 338
  • 347
  • 352
  • 362
  • 367
  • 377
  • 409
  • 415
  • 416
  • 426
  • 427
  • 457
  • 476
  • 488
  • 489
  • 494
  • 502
  • 522
  • 532
  • 611
  • 674
  • 732
  • 749
  • 758
  • 770
  • 772
  • 776
  • 787
  • 807
  • 829
  • 833
  • 862
  • 916
  • 918
  • 923
  • 1240
  • 1395

Prompt Preview

Apply the C++23 baseline first, then these Qt 6.10.3 rules for the modules the application actually uses.

Release scope and patch level

  • Treat 6.10.3 as the final 6.10 release, with standard support ending on 2026-10-07; plan migration to a maintained release line and inventory every backport applied to a retained 6.10.3 build.
  • Select an OS, compiler, architecture, and ABI from Qt 6.10's supported configurations. Qt requires C++17, while building Qt WebEngine requires C++20 and does not support MinGW; the included C++23 baseline additionally requires support for the C++23 features the application uses.
  • Apply the Qt 6.10 SVG patch for CVE-2026-6210 and the complete CVE-2026-8168 patch series, 0000 through 0004, before accepting untrusted SVG. These cover marker/mask type confusion and stack exhaustion during rendering, paint-server resolution, destruction, and cycle detection.
  • Apply the Qt5Compat patch for CVE-2026-9499 when shipping that module; QTextCodec::codecForName() can over-read non-NUL-terminated codec-name arrays, including QByteArray::fromRawData() views. Omit Qt5Compat when unused.
  • Apply the Qt Network patch for CVE-2026-76151 before connecting to untrusted HTTP servers: oversized Cache-Control response headers can crash 64-bit clients inside QNetworkAccessManager, before application body checks help.
  • Apply the Qt Base patches for CVE-2026-19248 and CVE-2026-78253 when processing untrusted XML; both DOM destruction and QXmlStreamReader::readElementText() can exhaust the stack. Until patched, avoid untrusted DOM trees and use