How severe is CVE-2026-19395?

CVE-2026-19395 has a CVSS 4.0 base score of 6.6, rated medium severity.

Is CVE-2026-19395 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-19395?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-19395 published?

CVE-2026-19395 was published on 2026-10-05 and last updated on 2026-10-06.

CVE-2026-19395

CVE-2026-19395 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-230.

Key facts

Severity: Medium (CVSS 4.0 base score 6.6)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-230
Published: 2026-10-05
Last modified: 2026-10-06

Description

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

Frequently asked questions

What is CVE-2026-19395?: In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
How severe is CVE-2026-19395?: CVE-2026-19395 has a CVSS 4.0 base score of 6.6, rated medium severity.
Is CVE-2026-19395 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-19395?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-19395 published?: CVE-2026-19395 was published on 2026-10-05 and last updated on 2026-10-06.

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:

Other CWE-230 vulnerabilities

CVE-2024-11024 — Critical (CVSS 9.8): The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover…
CVE-2024-10508 — Critical (CVSS 9.8): The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to…
CVE-2026-20086 — High (CVSS 8.6): A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS…
CVE-2024-9781 — High (CVSS 7.8): AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet…
CVE-2024-0048 — High (CVSS 7.8): In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to…
CVE-2024-0208 — High (CVSS 7.8): GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet…

Browse all CWE-230 vulnerabilities →