Vulnerability · Published Oct 5, 2026 · Assigned by Qt
CVE-2026-19395An empty <img> attribute value in styled text triggers a parser error that halts the device.
Medium 6.6
In plain English
A medium-severity security flaw in Qt for MCUs from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 4.0)6.6Medium
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| qt | Qt for MCUs | 2.12.0 – before 2.12.3 |
Weakness: CWE-617, CWE-230 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
References
- dev patch issue-tracking