CVE-2026-19395

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19395", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-08-10T07:19:46.149Z", "datePublished": "2026-10-05T09:18:28.379Z", "dateUpdated": "2026-10-05T12:04:27.598Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-10-05T09:18:28.379Z"}, "title": "An empty <img> attribute value in styled text triggers a parser error that halts the device.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-617", "description": "CWE-617 Reachable assertion", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-230", "description": "CWE-230 Improper handling of missing values", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "affected": [{"vendor": "qt", "product": "Qt for MCUs", "modules": ["qul"], "versions": [{"status": "affected", "version": "2.12.0", "lessThan": "2.12.3", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.12.0", "versionEndExcluding": "2.12.3"}]}]}], "descriptions": [{"lang": "en", "value": "In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Qt for MCUs, a Text element that displays styled text halts the device if an &lt;img&gt; tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.</p>"}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:", "name": "dev patch", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Claude AI (Opus 5.5) \u2014 draft only, requires human validation before submission"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T12:00:28.733595Z", "id": "CVE-2026-19395", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T12:04:27.598Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T12:00:28.733595Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T12:04:10.460Z"}}], "cna": {"title": "An empty <img> attribute value in styled text triggers a parser error that halts the device.", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "qt", "modules": ["qul"], "product": "Qt for MCUs", "versions": [{"status": "affected", "version": "2.12.0", "lessThan": "2.12.3", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:", "name": "dev patch", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Claude AI (Opus 5.5) \u2014 draft only, requires human validation before submission"}, "descriptions": [{"lang": "en", "value": "In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.", "supportingMedia": [{"type": "text/html", "value": "<p>In Qt for MCUs, a Text element that displays styled text halts the device if an &lt;img&gt; tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable assertion"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-230", "description": "CWE-230 Improper handling of missing values"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.12.3", "versionStartIncluding": "2.12.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-10-05T09:18:28.379Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19395", "state": "PUBLISHED", "dateUpdated": "2026-10-05T12:04:27.598Z", "dateReserved": "2026-08-10T07:19:46.149Z", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "datePublished": "2026-10-05T09:18:28.379Z", "assignerShortName": "Qt"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["qul"], "product": "Qt for MCUs", "vendor": "qt", "versions": [{"lessThan": "2.12.3", "status": "affected", "version": "2.12.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device."}], "id": "CVE-2026-19395", "lastModified": "2026-10-06T16:00:36.547", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19395", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T12:00:28.733595Z", "version": "2.0.3"}}]}, "published": "2026-10-05T10:16:41.923", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-230"}, {"lang": "en", "value": "CWE-617"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:41387", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "qt5-main-5.15.18-3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-18T00:00:00Z"}, {"advisory": "RHSA-2026:57634", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "qt6-main-6.11.2-1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-08-20T00:00:00Z"}], "bugzilla": {"description": "qt: qt: Denial of Service via empty image tag attribute in styled text", "id": "2545853", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545853"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-617", "details": ["In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.", "A flaw was found in Qt. When processing styled text in a Text element, the text parser improperly handles an image (<img>) tag containing an attribute with an empty value. An attacker can exploit this issue by supplying specially crafted styled text, causing an internal validation check to fail and triggering the error handler to halt the device, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-19395", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "qt6", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "qt", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "qt3", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "qt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "qt3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "qt5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "qt5", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-05T09:18:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19395\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19395\nhttps://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,2.12.3)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 88.0, "source": "matching"}]}, "original": {"product": "Qt for MCUs", "source": "cna", "vendor": "qt"}, "product": "qt_for_mcus", "vendor": "qt"}], "created": "2026-10-05T10:30:18.498270+00:00", "updated": "2026-10-06T20:45:05.918230+00:00", "vendors": ["qt", "qt$PRODUCT$qt_for_mcus"]}