CVE-2026-19395— An empty <img> attribute value in styled text triggers a parser error that halts the device.
Quick assessment
Affected
qt Qt for MCUs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Qt for MCUs 中，如果文本元素中用于显示格式化文本的 标签包含一个空值的属性，会导致设备停止运行。文本解析器会将空值传递给一个仅接受非空值的内部检查函数。该检查因无法处理空值而失败，并返回错误，随后默认错误处理器会中止设备运行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| qt | Qt for MCUs | 2.12.0< 2.12.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19395
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
An empty <img> attribute value in styled text triggers a parser error that halts the device.
Source: CVE Program / CVE List V5
Vulnerability Description
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| qt | Qt for MCUs | 2.12.0 ~ 2.12.3 | - |
|
II. Public POCs for CVE-2026-19395
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19395
请登录查看更多情报信息。
Vendor Pages for CVE-2026-19395 (1)
IV. Related Vulnerabilities
Same vendor: qt
-
CVE-2026-95509
Out-of-bounds read vulnerability in string formatting impact -
CVE-2026-79680
Authentication bypass vulnerability in the password authenti -
CVE-2026-78253
Denial-of-service (stack-exhaustion) vulnerability in QXmlSt -
CVE-2026-79616
Out-of-bounds read vulnerability in Context2D.path and PathS -
CVE-2026-76151
Out-of-bounds read (buffer over-read) vulnerability in HTTP
Same weakness: CWE-617
-
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected -
CVE-2026-20525
MOLY Modem输入验证缺陷致远程DoS漏洞 -
CVE-2026-104434
Zebra before 8.0.0 Denial of Service via z_listunifiedreceiv -
CVE-2026-104428
Zebra before 11.0.0 Denial of Service via getblock Verbosity -
CVE-2026-103108
Pexip Infinity 40.0前媒体输入验证致拒绝服务
V. Comments for CVE-2026-19395
No comments yet