CVE-2026-19248
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
CVE-2026-19248- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-80223
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
EUVD-2026-80223- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j2w2-j66p-cjg6
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when...
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
GHSA-j2w2-j66p-cjg6- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:X - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
CVE-2026-19248- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:X - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-19248
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
DEBIAN-CVE-2026-19248- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:X - Updated
- 2026-11-02
OSVOESA-2026-4212
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
- Record
OESA-2026-4212- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
Show 13 moreShow less
OSVOESA-2026-4344
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
- Record
OESA-2026-4344- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
OSVOESA-2026-4345
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
- Record
OESA-2026-4345- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
OSVOESA-2026-4346
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
- Record
OESA-2026-4346- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
OSVOESA-2026-4721
qt6-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
- Record
OESA-2026-4721- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-04
OSVOESA-2026-4722
qt6-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
- Record
OESA-2026-4722- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-04
OSVOESA-2026-4723
qt6-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
- Record
OESA-2026-4723- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-04
OSVRHSA-2026:59393
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:59393- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:68801
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:68801- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:87082
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
-
qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
-
qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:87082- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:93924
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
-
qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
-
qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:93924- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-19248
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- Record
UBUNTU-CVE-2026-19248- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-02
OSVALSA-2026:87082 No score
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
- qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
- qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:87082- Updated
- 2026-11-02
OSVALSA-2026:93924 No score
Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
- qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
- qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:93924- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt5-qtbaseAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-commonAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-examplesAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-guiAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-mysqlAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-odbcAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-postgresqlAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-private-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
qt5-qtbase-staticAlmaLinux:9 From an advisory covering 2 CVEs |
before 5.15.9-11.el9_8.2 | 5.15.9-11.el9_8.2 |
Show 59 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt5-qtbaseAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-commonAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-examplesAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-guiAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-mysqlAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-odbcAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-postgresqlAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-private-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt5-qtbase-staticAlmaLinux:8 From an advisory covering 2 CVEs |
before 5.15.3-10.el8_10 | 5.15.3-10.el8_10 |
qt6-baseDebian:12 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 45 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.1+dfsg-46.6.1+dfsg-56.6.1+dfsg-6 |
None known |
qt6-baseDebian:13 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 32 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
None known |
qt6-baseDebian:14 |
before 6.11.2+dfsg-5, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 29 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
6.11.2+dfsg-5 |
qtbase-opensource-srcDebian:12 |
All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 45 moreShow less5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-25.15.9+dfsg-3 |
None known |
qtbase-opensource-srcDebian:13 |
All versions, plus listed versions 5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1 Show 14 moreShow less5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-5 |
None known |
qtbase-opensource-srcDebian:14 |
before 5.15.19+dfsg-5, plus listed versions 5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2 Show 12 moreShow less5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-4 |
5.15.19+dfsg-5 |
qt5-qtbaseopenEuler:24.03-LTS-SP4 |
before 5.15.10-18.oe2403sp4 | 5.15.10-18.oe2403sp4 |
qt5-qtbaseopenEuler:24.03-LTS-SP1 |
before 5.15.10-18.oe2403sp1 | 5.15.10-18.oe2403sp1 |
qt5-qtbaseopenEuler:24.03-LTS-SP3 |
before 5.15.10-18.oe2403sp3 | 5.15.10-18.oe2403sp3 |
qt5-qtbaseopenEuler:22.03-LTS-SP4 |
before 5.15.2-21.oe2203sp4 | 5.15.2-21.oe2203sp4 |
qt6-qtbaseopenEuler:24.03-LTS-SP3 From an advisory covering 5 CVEs |
before 6.5.2-18.oe2403sp3 | 6.5.2-18.oe2403sp3 |
qt6-qtbaseopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.5.2-18.oe2403sp4 | 6.5.2-18.oe2403sp4 |
qt6-qtbaseopenEuler:24.03-LTS-SP1 From an advisory covering 5 CVEs |
before 6.5.2-18.oe2403sp1 | 6.5.2-18.oe2403sp1 |
qt6-qtbaseRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-commonRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-examplesRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-guiRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-ibaseRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-mysqlRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-odbcRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-postgresqlRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-private-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt6-qtbase-staticRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.11.2-2.hum1 | 0:6.11.2-2.hum1 |
qt5-qtbaseRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-commonRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-develRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-examplesRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-guiRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-ibaseRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-mysqlRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-odbcRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-postgresqlRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-private-develRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-staticRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbase-tdsRed Hat:hummingbird:1 |
before 0:5.15.18-5.2.hum1 | 0:5.15.18-5.2.hum1 |
qt5-qtbaseRocky Linux:9 From an advisory covering 2 CVEs |
before 0:5.15.9-11.el9_8.2 | 0:5.15.9-11.el9_8.2 |
qt5-qtbaseRocky Linux:8 From an advisory covering 2 CVEs |
before 0:5.15.3-10.el8_10 | 0:5.15.3-10.el8_10 |
qtbase-opensource-srcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 15 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2 |
None known |
qtbase-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 12 moreShow less5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2 |
None known |
qtbase-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 6 moreShow less5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4 |
None known |
qt6-baseUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1 |
None known |
qtbase-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3 Show 8 moreShow less5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3 |
None known |
qt6-baseUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5 |
None known |
qtbase-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1 Show 4 moreShow less5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1 |
None known |
qt6-baseUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2 |
None known |
qtbase-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2 |
None known |
qt6-baseUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7 |
None known |
qtbase-opensource-srcUbuntu:26.04:LTS |
All versions, plus listed versions 5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19248 is a high vulnerability (CVSS 7.1) in Qt, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in qt6-base 6.11.2+dfsg-5.
References
codereview.qt-project.org/c/qt/qtbase/+/740427
nvd.nist.gov/vuln/detail/CVE-2026-19248
github.com/advisories/GHSA-j2w2-j66p-cjg6
access.redhat.com/errata/RHSA-2026:87082
Show 36 moreShow less
bugzilla.redhat.com/2529762
errata.almalinux.org/9/ALSA-2026-87082.html
security-tracker.debian.org/tracker/CVE-2026-19248
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4212
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59393.json
cve.org/CVERecord?id=CVE-2026-19248
errata.rockylinux.org/RLSA-2026:87082
ubuntu.com/security/CVE-2026-19248
qt-project.atlassian.net/browse/QTBUG-147191
Left out here: 40 versions. The JSON record has them.