CVE-2026-19395

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

• CWE-230
• CWE-617

• https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19385Heap buffer overflow in PostgreSQL pg_dump of long function …8.8
• CVE-2026-19386A stack-based buffer overflow in the ASUS router modules all…9.3
• CVE-2026-19387A heap out-of-bounds write vulnerability was found in the GS…7.6
• CVE-2026-19389Multiple integer overflow and underflow vulnerabilities were…7.1
• CVE-2026-1939The Percent to Infograph plugin for WordPress is vulnerable …6.4
• CVE-2026-19391A flaw was found in insights-core where the password redacti…6.5
• CVE-2026-19396A predictable seed in the pseudo-random number generator (PR…7.7
• CVE-2026-19397Missing authentication for a critical function in ASUS Contr…7.7
• CVE-2026-19398An out-of-bounds write in the SmiFlash SMM module of ASUS FA…6.8
• CVE-2026-1940An incomplete fix for CVE-2024-47778 allows an out-of-bounds…7.5
• CVE-2026-19401Any remote client can crash a (debugging/non-release build t…7.5
• CVE-2026-19404A flaw was found in 389 Directory Server. The CleanAllRUV an…6.5