UBUNTU-CVE-2026-105946: Medium severity ubuntu/qtbase-opensource-src vulnerability
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Qt Network's QNetworkAccessManager or QTcpSocket are exposed when they perform NTLM authentication. The affected Ubuntu packages listed are qtbase-opensource-src and qt6-base.
What must an attacker control to exploit it?
An attacker needs to provide a crafted NTLM challenge through a malicious server or proxy. Exploitation also requires the application to authenticate using NTLM, and user interaction is required according to the supplied vector.
What is the likely impact of successful exploitation?
A successful exploit may disclose sensitive heap-memory contents or crash the application, causing a denial of service.