CVE-2026-19395

MediumCVSS 6.6

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values; the check fails and reports an error, and the default error handler halts the device.

Risk Assessment

A device running Qt for MCUs can be halted by crafted text, causing a denial of service. This can lead to unavailability of functions critical to device operation.

Recommendation

Update Qt for MCUs to a version containing the fix. Avoid processing untrusted text with <img> tags containing empty attributes.

Other vulnerabilities in Qt for MCUs

CVE-2026-94370Medium
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.

Original NVD description (English source)

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS