OESA-2026-4767: qt6-qtbase security update

Q: Which application workflows are exposed to the network-related issue?

Applications using QNetworkAccessManager or QTcpSocket are exposed when they authenticate with NTLM against a malicious server or proxy that sends a crafted NTLM challenge. The issue can disclose heap memory contents or crash the application.

Q: What input paths can trigger the Qt Core issues?

The CBOR-related issues are triggered when an application converts QCborValue data to JSON or passes specially crafted CBOR input to QCborValue::fromCbor(). The reported impacts include a NULL pointer dereference, an out-of-bounds read, application crashes, and possible information exposure.

Q: Is user interaction required for exploitation?

The provided severity vector indicates user interaction is required. The advisory does not specify what user action is needed.

Published Nov 11, 2026

Updated

Qt is a software toolkit for developing applications. Security Fix(es):

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)

Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)

Affected Software

1 affected componentFixes available

openeuler/qt6-qtbase<6.5.2-18.oe2403sp4

6.5.2-18.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/qt6-qtbase to a version that resolves this vulnerability.
Fixed in 6.5.2-18.oe2403sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which application workflows are exposed to the network-related issue?

Applications using QNetworkAccessManager or QTcpSocket are exposed when they authenticate with NTLM against a malicious server or proxy that sends a crafted NTLM challenge. The issue can disclose heap memory contents or crash the application.

What input paths can trigger the Qt Core issues?

The CBOR-related issues are triggered when an application converts QCborValue data to JSON or passes specially crafted CBOR input to QCborValue::fromCbor(). The reported impacts include a NULL pointer dereference, an out-of-bounds read, application crashes, and possible information exposure.

Is user interaction required for exploitation?

The provided severity vector indicates user interaction is required. The advisory does not specify what user action is needed.

OESA-2026-4767: qt6-qtbase security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which application workflows are exposed to the network-related issue?

What input paths can trigger the Qt Core issues?

Is user interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which application workflows are exposed to the network-related issue?

What input paths can trigger the Qt Core issues?

Is user interaction required for exploitation?