Live › vulnerability › CVE-2026-105946
Go to dashboardA crafted NTLM challenge from a malicious server or proxy makes the Qt Network module read past a buffer during QAuthenticator handling. An attacker can read heap memory from the client application or crash it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 07:30 UTC. All times on this page are UTC.
Applications built on Qt's Network module that authenticate with NTLM through QNetworkAccessManager or QTcpSocket, most often when talking to a proxy or server the application does not control. Applications that never use NTLM, or that only talk to trusted servers, are at much lower risk. unknown for the affected Qt version range.
No product ranges from the sources yet.
qmake --version or the Qt SDK version in the build environmentQNetworkAccessManager or QTcpSocket used with NTLM authenticationUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.
This page as .md · .json · in your agent: get_signal("CVE-2026-105946")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.