CVE-2026-51106

Executive Summary

CVE-2026-51106 is a denial-of-service (DoS) vulnerability affecting TokTok qTox v1.18.4, a popular open-source client for the Tox instant messaging protocol. The flaw resides in the src/persistence/serialize.cpp component and is triggerable by a local attacker, meaning the threat actor requires existing access to the target system or the ability to place a malicious file locally. Successful exploitation causes a denial of service, disrupting the application's functionality. As of this report, the vulnerability is unpatched (patch confidence 0/4), with no public exploit code, no CISA KEV inclusion, and no CVSS or EPSS scores assigned, making risk prioritization dependent on organizational context.

Technical Analysis

The NVD description identifies the vulnerable component as src/persistence/serialize.cpp in qTox v1.18.4. This file is part of the application's data persistence layer, responsible for serializing and deserializing internal state (e.g., chat history, profile data, settings) to and from disk. A flaw in this serialization logic allows a local attacker to trigger a denial-of-service condition.

Vulnerability Class: The issue likely falls within the class of memory-corruption (e.g., out-of-bounds read, null pointer dereference) or logic-error (e.g., infinite loop, improper input validation) vulnerabilities during deserialization. Because the vector is "local attacker," the trigger mechanism almost certainly involves crafting a malicious input file (e.g., a profile or history database) that, when loaded by qTox, causes the serialization parser to fail unsafely.

Attack Surface: The local attack surface includes any file that qTox reads via its persistence layer. Specifically, this includes:

• User profile files
• Chat history databases
• Configuration files

An attacker with write access to these file locations — or the ability to trick a user into replacing them — can plant a malformed file. Upon qTox startup or profile load, the serialization routine in serialize.cpp processes the malformed data, leading to a crash (e.g., segmentation fault from excessive memory allocation or buffer over-read).

Code-Level Consideration: The NVD description does not provide function-level identifier names beyond the file path src/persistence/serialize.cpp. Insufficient technical detail is available to pinpoint the exact faulty function or the precise malformed byte pattern. However, common deserialization failures in C++ persistence layers include:

• Unsigned integer overflow in size reads, leading to huge memory allocations
• Missing length validation before memcpy-like operations
• Improper header/magic-byte validation

No patch evidence exists from any tracked source, and the vendor has not issued a fix or advisory. This significantly raises the risk profile for deployments that cannot easily control local file integrity.

Exploitation Scenarios

Threat Model: Local attacker with low privileges (e.g., a co-user of a shared workstation, a malicious insider, or a process that has already achieved local code execution) OR a social engineering scenario where the victim is tricked into opening a malicious profile/history file.

Attack Chain:

1. Reconnaissance / Target Identification: The attacker determines that the target is running qTox v1.18.4. This can be verified by checking running processes, reading the executable version from disk, or observing the UI. The attacker also identifies the path where qTox stores persistence data (default Tox profile directories, e.g., ~/.config/tox/ or platform-specific equivalents).

2. Flaw Trigger Technique: The attacker crafts a malicious persistence file. The target byte sequences are specifically engineered to induce the vulnerability in src/persistence/serialize.cpp. Because the exact malformed structure is not publicly documented, the attacker must either reverse-engineer the serialization format or use fuzzing to discover a crashing input. The crafted file is then placed into the location where qTox reads persistence data, or the victim is socially engineered into importing it.

3. Payload / Execution Method: The attack is file-based and requires zero network interaction. The moment the victim launches qTox or switches to the affected profile, the application invokes the deserialization routines found in serialize.cpp. The malformed data is processed, triggering the denial-of-service condition — likely a process crash, hang, or excessive resource consumption.

4. Post-Exploitation Impact: The immediate impact is application unavailability. The victim cannot use qTox to communicate over the Tox network. If the crash occurs during a critical operation (like message delivery), there could be loss of unsaved data. In persistent scenarios, the attacker could repeatedly cause the crash, rendering the application unusable until manual file cleanup or profile restoration.

Important Note: No public PoC or exploit code is available. The attack chain above is inferred from the vulnerability class (local deserialization DoS) and the NVD description. Specific byte-level payload construction details are unknown.

Impact Assessment

• Technical Impact: Denial of service — application crash or hang. No evidence of remote code execution, privilege escalation, or data exfiltration from the NVD description.
• Business Impact: For individual users, the loss of a communication tool can be disruptive. For enterprises that deploy qTox for internal messaging, this can interrupt workflow and internal communications, potentially delaying incident response or critical information exchange.
• Affected Systems: qTox v1.18.4 running on any platform where a local attacker can modify the persistence files. This includes Linux, Windows, and macOS workstations.
• Blast Radius: Confined to the local machine and the qTox application itself. The Tox network protocol is unaffected; other Tox clients could continue operating normally. Data integrity of chat history may be at risk if the crafted file corrupts the database.
• CVSS Context: No CVSS vector is provided. In the absence of scoring, we assign a presumed low-to-medium severity for a local DoS vulnerability with no privilege escalation, but this should be validated by the organization's own risk framework.

Detection Guidance

Detection of this vulnerability requires visibility into file-level events at the host level and potentially process execution behavior. Since there is a single vulnerable version, the primary detection strategy is to identify the presence of qTox v1.18.4 and then monitor for crash conditions or file modification anomalies in the persistence directory.

Sigma Rule

title: Qtox Local Persistence File Tampering
id: 9f3f1b2c-5d4a-4e8f-9a2b-5c6d7e8f9a0b
status: experimental
description: Detects modification of qTox persistence files or abnormal process termination, indicative of exploitation of CVE-2026-51106 (local DoS via src/persistence/serialize.cpp).
author: Valtersit Threat Intel
date: 2026/03/11
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\qtox.exe'
    condition: selection
level: low
tags:
    - attack.t1499

Note: A more tailored Sigma rule would look for unusual file writes to the qTox profile directory. Since the exact file paths are not locally specified by the description and standard paths vary across OSes, this generic process rule is provided. For Linux, similar file-event rules using the file_event logsource and a directory watch for ~/.config/tox/ would be appropriate.

YARA Rule

rule Qtox_Profile_Corruption_CVE_2026_51106 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects qTox persistence header modifications associated with CVE-2026-51106 local DoS"
        target = "qTox"
        cve = "CVE-2026-51106"
        date = "2026-03-11"
    strings:
        $tox_magic = { 54 4F 58 00 } // "TOX\0" commonly seen in profile files; adjust as needed
        $qtox_header = "qTox" ascii
    condition:
        // Detect files that look like qTox data but contain anomalous size fields (placeholder)
        // Without specific signature, we can only look for qTox file indicators
        uint32(0) == 0x00584F54 or $qtox_header
}

Note: Current public details insufficient to derive unique static byte signatures. The rule above is a baseline that would generate high false positives; it can be tuned with deeper reverse engineering once a PoC exists.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-51106 Qtox Persistence DoS - Inbound File Transfer - Potential Malicious Profile Delivery"; flow:to_client; content:"|54 4F 58 00|"; nocase; metadata:attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_03_11, cve CVE_2026_51106; sid:2026051106; rev:1;)

Note: This rule detects the transfer of a file containing a qTox profile magic signature, assuming an attack vector where the malicious persistence file is delivered over the network (e.g., via chat file transfer) before being dropped locally. This is an inferred attack vector; the NVD description lists the attack as "local," so this network rule is supplementary and may not detect pure local attacks.

Elastic Detection

Since the payload is a local file, EQL queries should focus on process termination and file modification events:

configuration where
  // qTox process crashes after loading a profile
  process.name == "qtox.exe" and
  event.action == "process_stopped" and
  exit_code != 0

Additional EQL for file modification in profile directory:

any where
  event.category == "file" and
  event.action in ("write", "modification") and
  file.path : "C:\\Users\\*\\AppData\\Roaming\\tox\\*" or
  file.path : "/home/*/.config/tox/*" or
  file.path : "/Users/*/.config/tox/*"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security earliest=-7d
| where EventCode IN (4688, 4689) // Process Creation and Termination
| rename ImageProcessName as process_name
| lookup process_to_vendor ,output vendor_id
| search process_name=*qtox*
| eval vulnerable_version=if(ProductVersion="1.18.4","TRUE","FALSE")
| where vulnerable_version="TRUE"
| table _time, host, user, process_name, vulnerable_version, Status, ExitCode
| stats count by host, ExitCode
| where ExitCode != 0

Note: For file-level detection with FIM (file integrity monitoring), the query should be adapted to the FIM index source and watch for writes to the qTox profile directory.

Wazuh OSSEC Rule

<group name="qtox,">
  <rule id="100511" level="10">
    <decoded_as>syscheck</decoded_as>
    <field name="changedfile">\.config/tox</field>
    <description>qTox profile directory modified. Potential tampering related to CVE-2026-51106.</description>
    <group>pci_dss_11.4,</group>
  </rule>
  
  <rule id="100512" level="8">
    <decoded_as>syscheck</decoded_as>
    <field name="path_contains">\.local/share/tox</field>
    <description>qTox data changes detected - audit for local DoS exploitation.</description>
  </rule>
</group>

Note: Adapt the <field name> to match the actual syscheck output format for file paths in your Wazuh installation.

Mitigation & Patch Guidance

Patch Status: 0/4 — UNPATCHED. There is no vendor fix, no commit in public repositories, and no advisory from TokTok as of this report's date. The vendor has not provided a timeline for remediation.

Immediate Mitigations (1-2 weeks)

1. Restrict Local File Permissions: Strictly control write access to the qTox profile/persistence directories. Apply least-privilege to the directories so that only the legitimate user account can write. This limits the local attack surface to an attacker who has already compromised the user's account.
2. Deploy Host-Based Integrity Monitoring: Use FIM (e.g., Wazuh, Tripwire, AIDE) to monitor the qTox data directory for unexpected modifications.
3. Detect and Alert on Crashes: Configure the OS to log abnormal process terminations for qTox, and forward these events to the SIEM for alerting.
4. Least Privilege for Applications: Run qTox under a dedicated, low-privileged account where possible to reduce the attacker's influence over other system resources if the process is crashing.

Patch / Upgrade Steps (1-3 months)

1. Monitor for Vendor Release: Subscribe to the qTox GitHub repository (github.com/qTox/qTox) and release announcements. Test and deploy an update as soon as it is available.
2. Maintain a Rollout Plan: Since no patch exists, document a contingency process for rapid deployment of the patched version once released.
3. If available, downgrade or switch: Evaluate alternative Tox clients (e.g., toxic-cli) as a stop-gap for time-sensitive users, only if the alternative is verified to be unaffected by the same serialization flaw.

Long-Term Hardening

1. Network Segmentation: If feasible, isolate machines running qTox from the most high-value production assets to contain the blast radius.
2. Security Architecture Review: Evaluate whether local file-based vulnerabilities like this are considered in your threat model, and ensure FIM and process monitoring are part of your baseline for all workstations.
3. Vendor Monitoring: Incorporate a routine review of the qTox changelog to identify and react to security-related patches faster.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-51106 — Official NVD record, currently holds the description and status (unpublished scoring/N/A).
2. qTox GitHub Repository: https://github.com/qTox/qTox — The relevant code component src/persistence/serialize.cpp can be audited here (v1.18.4 tag).
3. TokTok Project Site: https://toktok.ltd/ — Vendor / upstream project home; monitor for security advisories.
4. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No entry exists for this CVE as of the report date; monitor for changes.
5. FIRST EPSS Feed: https://www.first.org/epss/ — No score assigned yet; revisit periodically for updated threat metrics.

Threat Actor Activity: No known threat actors, ransomware campaigns, or exploit-in-the-wild evidence are associated with CVE-2026-51106 at the time of writing. The lack of public PoC and the local attack vector make widespread weaponization unlikely in the near term, but targeted attacks should not be ruled out.