UBUNTU-CVE-2026-82292: Null Pointer Dereference
Published Nov 12, 2026
·Updated
A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).
Affected Software
11 affected components
ubuntu/qtbase-opensource-src*
ubuntu/qtbase-opensource-src*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What input must an attacker control to trigger the issue?
An attacker would need to cause an application using the Qt XML module to parse XML through QDomDocument::setContent(). The provided information does not specify the exact malformed XML structure required.
2
Which Ubuntu packages are identified as affected?
The affected software listed is ubuntu/qtbase-opensource-src and ubuntu/qt6-base.
3
Are applications unaffected if they do not parse XML with QDomDocument::setContent()?
Based on the available description, the vulnerable path is QDomDocument::setContent() in the Qt XML module. The data does not identify other Qt XML parsing APIs as affected.