This vulnerability involves an out-of-bounds read (CWE-125) caused by incorrect buffer size calculation in the String.arg() method when handling Latin-1 optimized strings in Qt for MCUs. The flaw arises from improper handling of Latin-1 character strings, leading to reading beyond the allocated buffer. The affected versions are Qt for MCUs >=2.6.0 <2.11.3 and >=2.12.0 <2.12.3. The CVSS 4.0 score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. No known exploits in the wild have been reported. No patch links or vendor advisory details are provided in the input data.

Successful exploitation can cause out-of-bounds memory reads, which may lead to application crashes or potential exposure of sensitive memory contents. The vulnerability affects the integrity and availability of applications using the affected Qt for MCUs versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the input data, users should monitor Qt's official channels for updates. Until a fix is available, avoid processing untrusted Latin-1 optimized strings with String.arg() in the affected versions.