Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-96432

Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Qt

Description

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

qt qt

Default version status: unaffected

  • 6.8.0 to ≤ 6.8.9affected
  • 6.9.0 to ≤ 6.11.2affected

References