CVE-2026-19395

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: TQtC

Description

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-19395

EUVD

EUVD-2026-92384

Affected Vendors & Products

Vendor	Product	Version / Range
qt	Qt	for MCUs 2.12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-230	The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

In Qt for MCUs, a Text element displaying styled text halts the device if an <img> tag contains an attribute with an empty value. The text parser passes this empty value to an internal check that requires non-empty values. The check fails, triggering an error that halts the device.

Detection Guidance

This vulnerability can be detected by inspecting Qt for MCUs applications for Text elements that process styled text containing <img> tags with empty attributes. Check application logs for parser errors or device halts when such tags are encountered. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause a denial of service by halting the device when malformed styled text with an empty <img> attribute is processed. It may disrupt operations relying on the Qt for MCUs framework.

Compliance Impact

This vulnerability causes device halting due to improper handling of empty attributes in styled text tags, which could lead to denial of service. Such disruptions may impact compliance with standards requiring continuous availability, such as GDPR's data processing requirements or HIPAA's operational safeguards.

Mitigation Strategies

Update Qt for MCUs to the latest version to patch the vulnerability. Avoid using styled text with <img> tags containing empty attributes in Text elements. Review and sanitize all text inputs to prevent malformed tags.

Hi! I’m here to help you understand CVE-2026-19395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70