Vulnerability in Qt for MCUs

[ Description ]Official description

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund29 Sep 2026WID-SEC-2026-3653

  QT for MCUs: Multiple vulnerabilities allow denial of service and data manipulation Translated from German

  CVE-2026-95509CVE-2026-19395

[ References ]References

• wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products