CVE-2026-51106: n/a

This vulnerability in TokTok qTox v1.18.4 involves the src/persistence/serialize.cpp component, where a local attacker can trigger a denial of service condition. The underlying issues relate to unsafe deserialization and resource consumption vulnerabilities (CWE-502 and CWE-400). The CVSS vector indicates the attack can be performed remotely over the network with low complexity and no privileges, requiring user interaction, and results in a complete loss of confidentiality and integrity. There is no known exploit in the wild and no vendor advisory or patch information is currently provided.

An attacker can cause a denial of service on affected TokTok qTox installations, potentially disrupting service availability. The CVSS vector also indicates high confidentiality and integrity impacts, meaning sensitive data could be exposed or altered. However, availability impact is marked as none in the CVSS vector, which may indicate the denial of service is limited or partial. No active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a patch is available, limiting local access and cautious user interaction may reduce risk.