CVE-2026-13326

Executive Summary

CVE-2026-13326 is an out-of-bounds read (CWE-125) in Qt NFC's language code length parsing logic. A physically proximate attacker can deliver a crafted NFC tag that causes the parsing routine to read beyond the bounds of an allocated buffer, resulting in either a denial-of-service condition or limited disclosure of adjacent memory contents. Because exploitation requires physical proximity to the target device's NFC reader and no public proof-of-concept, Nuclei template, or exploit code currently exists, the immediate operational risk is elevated for kiosk, access-control, retail POS, and industrial field devices that continuously poll for NFC tags — not for typical internet-facing server workloads.

Technical Analysis

Qt NFC is the Qt framework module that provides NFC (Near Field Communication) functionality to Qt-based applications across desktop, mobile, and embedded platforms. The vulnerability is classified CWE-125 (Out-of-Bounds Read) and, per the NVD description, resides in the parsing of a "language code length" field within NFC data that the library processes.

NFC data exchange is built on NDEF (NFC Data Exchange Format) messages. Within the NDEF specification, Text records carry a status byte whose low bits encode the length of an ISO/IANA language code that precedes the payload text. A parser must read that length value and then consume exactly that many bytes of language code before the remainder of the record is treated as payload. When a length field is attacker-controlled and the parser fails to validate it against the actual number of bytes remaining in the record buffer, the parser's read pointer can be advanced beyond the end of the allocated buffer. This is the classic out-of-bounds read pattern: the code trusts a length value supplied in the input rather than clamping it to the size of the containing buffer.

The available description does not disclose the specific function, class, or source file within Qt NFC where the defect resides, and per reporting constraints no such identifier is asserted here. What can be stated at the vulnerability-class level is:

• Trigger surface: NFC tag content, specifically the language code length field in an NDEF record parsed by the Qt NFC stack.
• Trust boundary violation: untrusted, attacker-controlled tag data is used directly as a length input to a memory access without adequate bounds checking.
• Primitive: an out-of-bounds read — the program reads bytes outside the intended buffer.
• Consequences per NVD: (a) denial of service (most plausibly via a crash/abort when the read crosses a page boundary or violates an assertion/sanitizer build) and (b) "limited memory disclosure" (adjacent heap or stack bytes returned to the caller or logged/output by the application).

The "limited" qualifier on memory disclosure is consistent with an OOB read bounded by the size of the language code length field (a small value), rather than a large arbitrary heap dump. Nonetheless, any read outside intended bounds can leak pointers, heap metadata, or fragments of prior allocations, which are useful to a more sophisticated attacker for defeating ASLR or heap layout randomization in a chained exploit.

Because the NVD entry does not specify whether the length is a single byte, a multi-byte value, or the exact arithmetic performed, this report deliberately does not fabricate the parsing algorithm. The precise trigger value, offset, and buffer geometry would require source-level review of the affected Qt NFC release once a patch or advisory is published.

Exploitation Scenarios

No public proof-of-concept exists; the attack chain below is inferred strictly from the vulnerability class and the NVD description. It contains no invented function names, endpoints, or parameters.

1. Reconnaissance / target identification. Unlike remote network CVEs, this vulnerability has no internet-facing fingerprint. The attacker must identify a target device that (a) runs software built on Qt NFC and (b) actively reads NFC tags — e.g., point-of-sale terminals, badge/access-control readers, information kiosks, hotel/room key systems, or industrial HMI panels. Identification is physical: the attacker observes that the device has an NFC antenna/indicator and polls for tag presence.

2. Triggering the flaw class. The attacker prepares an NFC tag containing an NDEF Text record whose language code length field is crafted to be inconsistent with the actual data length within the record. When the victim device reads the tag, Qt NFC's language code length parsing consumes the attacker-supplied length without sufficient validation and reads past the end of the buffer. At the vulnerability-class level: a malformed length field in a Text record causes an out-of-bounds read in the parser.

3. Delivery / execution method. Delivery is purely local and contactless: the attacker presents the crafted tag within the NFC read range (typically a few centimeters) of the victim device's antenna. No network path, authentication, or user interaction beyond the device's normal "tag present" polling is required. A single tap or proximity placement is sufficient.

4. Post-exploitation impact. Per NVD, outcomes are (i) denial of service — the out-of-bounds read triggers a crash or abort that takes the NFC-reading service or application offline, and (ii) limited memory disclosure — bytes adjacent to the parsed buffer are exposed. In a kiosk or access-control context, a crash can lock out legitimate users or halt operations until the service restarts. The disclosure primitive is small but can contribute to ASLR bypass in a larger exploit chain. No code execution, privilege escalation, or data-write primitive is claimed by the source data.

Attack chain caveat: because no PoC, exploit code, or Nuclei template is available, steps 2–3 describe the mechanism at the vulnerability-class level and should be validated against the eventual vendor advisory or patch diff.

Impact Assessment

• Confidentiality: Low — "limited memory disclosure" of adjacent buffer contents. In isolation this leaks no credentials or files, but can reveal memory layout information.
• Integrity: None demonstrated — no write primitive is described.
• Availability: Low-to-Moderate — the read can crash the parsing process, causing DoS on devices that depend on NFC input (access control, kiosks, POS). The blast radius is per-device; there is no wormable or lateral-movement component.
• Attack Vector / Privileges / User Interaction: Physical/adjacent (proximate) access; no privileges required; minimal or no user interaction (device polling is the trigger).
• CVSS: Not provided by NVD or CNA. Per the reporting constraint, no score is fabricated. Based on the described attributes (proximate access, no privileges, DoS plus limited info disclosure) the qualitative severity sits in the Low-to-Medium band, but this is an assessment, not a published score.
• Blast radius: Embedded, mobile, and desktop deployments using Qt NFC that handle untrusted tags. Internet-facing server workloads are effectively out of scope because they do not expose NFC tag parsing as a remote service.

Detection Guidance

Detection focuses on application/host telemetry (Qt NFC parsing crashes, sanitizer alerts, anomalous memory-read faults) rather than network signatures, since the trigger is local RF. The network rules below target adjacent-layer observability (NFC proxy services, tag-provisioning backends, MQTT/HTTP bridges that forward tag data) and are provided for defense-in-depth.

Sigma Rule

title: Qt NFC Out-of-Bounds Read / Crash on Malformed NDEF Language Code
id: 8f2c1e7a-3b4d-4a91-9c22-qt-nfc-cve202613326
status: experimental
description: Detects crashes or sanitizer alerts in processes using Qt NFC consistent with an out-of-bounds read in language code length parsing (CVE-2026-13326).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13326
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/qt-nfc-service'
      - '/nfcd'
    ProcessName|contains: 'Qt'
  selection_fault:
    - Message|contains: 'AddressSanitizer: heap-buffer-overflow'
    - Message|contains: 'READ of size'
    - Message|contains: 'out-of-bounds'
    - Message|contains: 'SIGSEGV'
    - Message|contains: 'SIGABRT'
  selection_qt:
    Message|contains: 'QNdef'
  condition: selection_process and (selection_fault or selection_qt)
falsepositives:
  - Legitimate application crashes unrelated to NFC parsing
  - Debug/sanitizer builds during normal QA testing
level: medium
tags:
  - attack.t1499
  - cwe.125

YARA Rule

rule CVE_2026_13326_QtNFC_NDEF_Text_LangCode
{
    meta:
        description = "Detects NFC tag dumps / NDEF artifacts with anomalous Text record language code length potentially triggering CVE-2026-13326 in Qt NFC parsers"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13326"
        date = "2026-01-01"
        cwe = "CWE-125"

    strings:
        // NDEF Text record type identifier 'T'
        $ndef_text = { 54 }
        // NDEF Text record type-name-format/length status byte high bit set (UTF-8 language length encoding)
        $lang_status = { 8? 0? }

    condition:
        $ndef_text at 0 and
        filesize < 4KB and
        // Heuristic: presence of NDEF Text record layout with short total length
        uint16be(0) < 0x0100
}

Note: YARA is a static file-matching language; this rule is a heuristic for NFC capture artifacts (e.g., sniffed tag dumps or NDEF payload files) and should be tuned against your own tag-dump corpus. It intentionally avoids asserting a specific malformed byte value that is not documented in the source data.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-13326 Qt NFC NDEF Text Record Language Length Anomaly (possible exploit delivery via tag-bridge)"; flow:established,to_server; content:"NDEF"; nocase; content:"Text"; nocase; pcre:"/\x02[\x80-\xFF].{0,2}/"; reference:cve,2026-13326; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13326; classtype:attempted-dos; sid:202613326; rev:1;)

Caveat: NFC tag reads are not typically visible on IP networks. This rule is only useful when a gateway, tag-provisioning service, or testing harness serializes NDEF records into HTTP/JSON. It is provided for defense-in-depth and should be adapted to the actual bridge format in use.

Elastic Detection

process where process.name : ("qt-nfc-service", "nfcd") and
  (
    process.exit_code != 0 or
    message : "AddressSanitizer" or
    message : "heap-buffer-overflow" or
    message : "out-of-bounds" or
    message : "SIGSEGV" or
    message : "SIGABRT"
  )

Query intent: surface abnormal terminations of the Qt NFC reader process that correlate with tag-present events, which is the strongest available host-side signal for an exploitation attempt (crash-on-malformed-tag). Validate field names (message, process.exit_code) against your Elastic Common Schema mapping.

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=app_logs)
(process_name IN ("qt-nfc-service","nfcd") OR message IN ("*QtNfc*","*QNdef*"))
(message="*AddressSanitizer*" OR message="*out-of-bounds*" OR message="*heap-buffer-overflow*" OR message="*SIGSEGV*" OR message="*SIGABRT*" OR tag="nfc_reader_error")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as evidence by host process_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Purpose: aggregate NFC parser crash events per host to distinguish a malformed-tag DoS from isolated software faults.

Wazuh OSSEC Rule

<group name="qt_nfc,cve_2026_13326,">
  <rule id="202613326" level="8">
    <decoded_as>syslog</decoded_as>
    <match>qt-nfc-service|nfcd|QNdef|QNfc</match>
    <regex>AddressSanitizer|out-of-bounds|heap-buffer-overflow|SIGSEGV|SIGABRT</regex>
    <description>CVE-2026-13326: Possible Qt NFC out-of-bounds read triggered by malformed NFC tag (NDEF language code length parsing)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cwe_125,</group>
  </rule>
</group>

Deploy on hosts running Qt NFC reader services; tune <match> and <regex> to the actual daemon name and log format.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable or restrict NFC tag-reading functionality on devices that do not require it (many access-control, kiosk, and embedded targets enable NFC by default).
   • Where NFC must remain active, isolate the NFC-reading service using OS-level sandboxing, seccomp/AppArmor (Linux) or MAC frameworks on other platforms, and run it under a low-privilege account with ASLR and stack canaries enabled.
   • Deploy reader-side filtering: reject or quarantine NDEF Text records whose language code length field is inconsistent with the remaining record length before the record reaches the Qt NFC parser. This is a compensating control in front of the vulnerable library.
   • Physically secure or monitor devices with active NFC antennas to raise the attacker's proximity cost (access control, tamper monitoring, enclosure shielding where feasible).
   • Enable crash telemetry (systemd-coredump, ASAN builds in test environments) so malformed-tag DoS attempts are detectable.

2. Patch / upgrade steps

   • Monitor the official Qt security advisories and the NVD entry for CVE-2026-13326 for a fixed Qt release.
   • As of this report, no affected-version range, vendor fix, or patch reference is available from any tracked source. Do not assume a specific fixed version exists.
   • Once a fixed Qt version is published, inventory all products embedding Qt NFC (including third-party SDKs and firmware), determine which depend on the affected module, and set a staged upgrade plan. Because Qt is frequently statically linked into embedded firmware, upgrade coordination may require vendor firmware updates rather than simple package upgrades.

3. Long-term hardening

   • Adopt a "never trust tag-supplied lengths" parsing standard: treat all NDEF length fields as attacker-controlled and clamp them to buffer bounds (root-cause fix for CWE-125).
   • Fuzz the NFC/NDEF parsing surface (AFL++, libFuzzer with NDEF seed corpora) as part of CI for products shipping Qt NFC.
   • Compile with hardening flags (-D_FORTIFY_SOURCE=3, ASAN/UBSAN in CI) to catch out-of-bounds reads pre-release.
   • Maintain a software bill of materials that includes embedded libraries such as Qt NFC so future CVEs in the module can be mapped to affected devices quickly.

References

1. NVD — CVE-2026-13326: https://nvd.nist.gov/vuln/detail/CVE-2026-13326
2. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. Qt Security Advisories (monitor for CVE-2026-13326 patch): https://www.qt.io/blog/security-advisories (verify current advisory index)
4. MITRE ATT&CK — T1200 Hardware Additions / T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1200/ , https://attack.mitre.org/techniques/T1499/
5. NFC Forum — NDEF specification (for the Text record format relevant to language code parsing): https://nfc-forum.org/our-work/specifications-and-application-documents/

Threat actor / exploit-in-the-wild: None. CISA KEV status: NO. No public PoC, exploit code, or Nuclei template was identified at time of writing, and no campaign attributions exist for this CVE.