{"id":"CVE-2026-105946","kind":"vulnerability","aliases":["CVE-2026-105946"],"related":[],"title":"Qt: NTLM challenge parsing reads out of bounds, leaking heap memory","description":"Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.","summary":"A crafted NTLM challenge from a malicious server or proxy makes the Qt Network module read past a buffer during QAuthenticator handling. An attacker can read heap memory from the client application or crash it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-apps","ntlm","qt","runtime"],"not_affected_if":["no-ntlm-auth","trusted-servers-only"],"how_to_check":"- Check the installed Qt version with `qmake --version` or the Qt SDK version in the build environment\n- Search the code for `QNetworkAccessManager` or `QTcpSocket` used with NTLM authentication","fix":null,"status":"open","published_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","triaged_at":"2026-10-27T07:31:57+00:00","updated_at":"2026-10-27T07:31:57+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T07:31:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Qt: NTLM challenge parsing reads out of bounds, leaking heap memory","impact":"medium","summary":"A crafted NTLM challenge from a malicious server or proxy makes the Qt Network module read past a buffer during QAuthenticator handling. An attacker can read heap memory from the client application or crash it.","category":"runtime","nicknames":[],"who_cares":["qt","desktop-apps","ntlm"],"confidence":0.5,"needs_auth":"no","worst_case":"Heap memory leaks to a malicious server, or the application crashes","analyst_note":"Find the fixed Qt versions and the affected range from the Qt advisory or NVD configuration; the source gave no version data.","how_to_check":"- Check the installed Qt version with `qmake --version` or the Qt SDK version in the build environment\n- Search the code for `QNetworkAccessManager` or `QTcpSocket` used with NTLM authentication","needs_analyst":true,"not_affected_if":["no-ntlm-auth","trusted-servers-only"],"who_is_affected":"Applications built on Qt's Network module that authenticate with NTLM through QNetworkAccessManager or QTcpSocket, most often when talking to a proxy or server the application does not control. Applications that never use NTLM, or that only talk to trusted servers, are at much lower risk. unknown for the affected Qt version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000599,"input_tokens":3365,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105946':14A,17A '-2026':13A,16A 'allow':78C 'app':20B 'applic':55B,94C,110C 'attack':47B,80C 'authent':67C,115C 'bound':8A,61C 'buffer':42B 'caus':89C 'challeng':3A,27B,100C 'client':54B 'content':87C 'craft':25B,98C 'crash':57B,95C 'cve':12A,15A 'denial':91C 'desktop':19B 'desktop-app':18B 'group':76C 'handl':45B,68C 'heap':10A,50B,85C 'inform':84C 'leak':9A 'make':34B 'malici':30B,104C 'memori':11A,51B,86C 'modul':38B,73C 'network':37B,72C 'ntlm':2A,21B,26B,66C,99C,117C 'obtain':82C 'out-of-bound':58C 'pars':4A 'past':40B 'proxi':33B,107C 'qauthent':44B,65C 'qnetworkaccessmanag':112C 'qt':1A,22B,36B,71C,75C,77C 'qtcpsocket':114C 'read':5A,39B,49B,62C 'remot':79C 'runtim':23B 'sensit':83C 'sent':101C 'server':31B,105C 'servic':93C 'use':111C 'via':96C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Qt's Network module that authenticate with NTLM through QNetworkAccessManager or QTcpSocket, most often when talking to a proxy or server the application does not control. Applications that never use NTLM, or that only talk to trusted servers, are at much lower risk. unknown for the affected Qt version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105946","severity":null,"published_at":"2026-10-27T07:16:31+00:00","modified_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:44+00:00","fetched_at":"2026-10-27T07:30:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}