OESA-2026-4723: qt6-qtbase security update
Qt is a software toolkit for developing applications. Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qt6-qtbaseto a version that resolves this vulnerability.Fixed in 6.5.2-18.oe2403sp1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are most exposed to the network-related issues?
Applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM are exposed when they connect to a malicious server or use a malicious proxy that sends a crafted NTLM challenge. Applications that process HTTP responses may also be exposed to the Cache-Control parsing issue.
Can untrusted local or application-supplied data trigger any of these issues?
Yes. Specially crafted CBOR passed to QCborValue::fromCbor() can cause an out-of-bounds read, and untrusted XML processed by QDomDocument can trigger a denial-of-service crash. The QCborValue-to-JSON conversion issue can also cause a NULL pointer dereference.
What impact can a remote attacker achieve?
The NTLM handling flaw can expose heap-memory contents or crash the application. The CBOR, XML, and HTTP Cache-Control parsing issues can crash affected applications; the CBOR issue could also expose information.
Which Qt versions are identified for the HTTP Cache-Control parsing flaw?
The affected ranges listed for that issue are Qt 6.0.0 through 6.8.8 and Qt 6.9.0 through 6.11.1.