CVE-2026-19395
Qt for MCUs: An empty <img> attribute value in styled text triggers a parser error that halts the device.
qt Qt for MCUs
CVSS
6.6MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.12.3Qt for MCUsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
Text from CVE List
Affected versions 1
- Qt for MCUsaffected: 2.12.0 before 2.12.3CVE List