CVE-2026-19395 An empty <img> attribute value in styled text triggers a parser error that halts the device.
An attacker can halt an embedded device by providing styled text with an empty image attribute, causing a parser error in Qt for MCUs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19395?
CVE-2026-19395 is a medium-severity denial of service vulnerability in Qt for MCUs, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
Which versions are affected by CVE-2026-19395?
Linux distribution packages (8)
qt5 Red Hat:hummingbird:1 | All versions | 0:5.15.18-3.hum1 |
qt5-filesystem Red Hat:hummingbird:1 | All versions | 0:5.15.18-3.hum1 |
qt5-rpm-macros Red Hat:hummingbird:1 | All versions | 0:5.15.18-3.hum1 |
qt5-srpm-macros Red Hat:hummingbird:1 | All versions | 0:5.15.18-3.hum1 |
qt6 Red Hat:hummingbird:1 | All versions | 0:6.11.2-1.hum1 |
qt6-filesystem Red Hat:hummingbird:1 | All versions | 0:6.11.2-1.hum1 |
qt6-rpm-macros Red Hat:hummingbird:1 | All versions | 0:6.11.2-1.hum1 |
qt6-srpm-macros Red Hat:hummingbird:1 | All versions | 0:6.11.2-1.hum1 |
How do I fix CVE-2026-19395?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-19395 being exploited?
There is no known exploitation of CVE-2026-19395 in the wild and no public exploit code.
Sources
Also known as GHSA-4vr6-gg46-c2vh, RHSA-2026:41387, RHSA-2026:57634.