Description

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-26T19:16:50.800Z",
  "pubdate": "2026-08-26T19:16:50.800Z",
  "executiveSummary": "A local denial-of-service vulnerability exists in qTox version 1.18.4, specifically within the data persistence serialization logic.\nThe vulnerability resides in the src/persistence/serialize.cpp component, which is responsible for managing the serialization and deserialization of local configuration or state files.\nA local attacker with the ability to modify or inject malicious data into the application's local persistence files can trigger an unhandled exception or resource exhaustion during the parsing process.\nSuccessful exploitation results in the application process crashing, leading to a denial-of-service condition for the local user.\nThis vulnerability is restricted to local attack vectors, requiring the adversary to have filesystem access to the qTox profile directory.\nThe risk is primarily localized to the availability of the qTox client, potentially leading to loss of access to messaging history or application functionality until the corrupted persistence file is cleared or corrected.\nNo remote code execution or privilege escalation is inherent to this specific flaw, focusing strictly on service availability through input validation failure.",
  "technicalDetails": "The vulnerability is located within the src/persistence/serialize.cpp component of qTox v1.18.4, which handles the complex task of serializing and deserializing data structures into local storage.\nThe root cause is an improper handling of input data during the deserialization process. When the application attempts to reconstruct state information from a stored file, it fails to perform adequate bounds checking or structure validation on the serialized input.\nAn attacker can exploit this by crafting a malformed persistence file that violates expected schema constraints or contains unexpected data types. When qTox reads this file at startup or during a runtime refresh, the deserialization logic in src/persistence/serialize.cpp triggers a logic error.\nSpecifically, the attack flow involves the following steps: 1) The attacker identifies the user profile directory where qTox stores its persistence files. 2) The attacker overwrites or modifies the targeted serialization file with a crafted payload. 3) The attacker launches or interacts with the qTox client to trigger the read operation. 4) The src/persistence/serialize.cpp component attempts to parse the corrupted data. 5) The absence of robust error handling or validation routines causes the application to encounter a fatal exception, leading to an immediate process termination (crash).\nBecause the component relies on specific parsing logic for complex objects, the lack of secure deserialization practices allows the input to dictate control flow, which effectively forces the application into an unstable state. This represents a breakdown in the integrity of the data processing pipeline.\nThe vulnerability does not require authentication to the qTox application itself, as the exploit targets the underlying file access layer. However, it does require the attacker to have filesystem-level permissions sufficient to manipulate files owned by the user running the qTox instance.\nPost-exploitation, the primary impact is the unavailability of the client. As the persistence file is likely re-read upon subsequent attempts to launch the application, the DoS condition may persist across restarts until the user manually intervenes to delete or restore the corrupted configuration file.\nThe technical failure stems from inadequate validation during deserialization, which is a known vector for stability issues in software handling persistent state."
}