{"id":"CVE-2026-19395","aliases":["EUVD-2026-92384","GHSA-4vr6-gg46-c2vh","RHSA-2026:41387","RHSA-2026:57634"],"status":"published","title":"An empty \u003cimg\u003e attribute value in styled text triggers a parser error that halts the device.","description":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00253,"percentile":0.16962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-230","CWE-617"],"published":"2026-10-05T09:18:28Z","modified":"2026-10-16T10:20:32Z","fixes":[{"ecosystem":"Red Hat:hummingbird:1","package":"qt5","fixed_in":["0:5.15.18-3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt5-filesystem","fixed_in":["0:5.15.18-3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt5-rpm-macros","fixed_in":["0:5.15.18-3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt5-srpm-macros","fixed_in":["0:5.15.18-3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt6","fixed_in":["0:6.11.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt6-filesystem","fixed_in":["0:6.11.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt6-rpm-macros","fixed_in":["0:6.11.2-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"qt6-srpm-macros","fixed_in":["0:6.11.2-1.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.18-3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt5-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.18-3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt5-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.18-3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt5-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.18-3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt6-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt6-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.2-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"qt6-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.2-1.hum1"}]}]}],"products":[{"vendor":"qt","product":"qt for mcus"}],"references":[{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:","tags":["issue-tracking","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19395","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vr6-gg46-c2vh"},{"url":"https://access.redhat.com/errata/RHSA-2026:41387","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19395","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41387.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19395","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57634","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57634.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-19395","title":"An empty \u003cimg\u003e attribute value in styled text triggers a parser error that halts the device.","description":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.","status":"published","published":"2026-10-05T09:18:28.379Z","modified":"2026-10-05T12:04:27.598Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna"}],"cwes":["CWE-617","CWE-230"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-92384","description":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.","status":"published","published":"2026-10-05T09:18:28Z","modified":"2026-10-05T12:04:27Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T17:27:40.640907Z"}],"ghsa":[{"id":"GHSA-4vr6-gg46-c2vh","title":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the...","description":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.","status":"published","published":"2026-10-05T12:31:25Z","modified":"2026-10-05T12:31:26Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-230"],"updated_at":"2026-11-02T15:12:48.068686Z"}],"nvd":[{"id":"CVE-2026-19395","description":"In Qt for MCUs, a Text element that displays styled text halts the device if an \u003cimg\u003e tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.","status":"published","published":"2026-10-05T10:16:41.923Z","modified":"2026-10-06T16:00:36.547Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-230","CWE-617"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"RHSA-2026:41387","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:10:30Z","modified":"2026-10-16T10:17:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:57634","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:13:40Z","modified":"2026-10-16T10:20:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"}]}}