OESA-2026-4721: qt6-qtbase security update
Qt is a software toolkit for developing applications. Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qt6-qtbaseto a version that resolves this vulnerability.Fixed in 6.5.2-18.oe2403sp3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which application functions are exposed by these issues?
Applications are exposed when they process untrusted CBOR through QCborValue::fromCbor() or CBOR-to-JSON conversion, parse untrusted XML with QDomDocument, handle NTLM authentication through QNetworkAccessManager or QTcpSocket, or parse HTTP Cache-Control response headers.
What does an attacker need to control to exploit the network-related issues?
For the NTLM issue, an attacker needs to provide a crafted NTLM challenge from a malicious server or proxy while the application authenticates with NTLM. The HTTP parsing issue can be triggered with an excessively large Cache-Control response header.
What impact is described for affected applications?
The reported impacts include application crashes and denial of service. The CBOR and NTLM issues may also expose sensitive information, including heap memory contents for the NTLM flaw.
Which Qt versions are identified for the HTTP Cache-Control parsing issue?
The affected ranges stated for that issue are Qt 6.0.0 through 6.8.8 and Qt 6.9.0 through 6.11.1. No fixed version or non-patching workaround is provided in the available data.