CVE-2026-19395: qt qt_for_mcus Improper Handling of Missing Values

Vulnerability summary

CVE-2026-19395 is a medium (CVSS 6.6) Improper Handling of Missing Values vulnerability in qt qt_for_mcus. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 05-10-2026
   Last modifiedVulnerability information updated.

Description

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.

• CWE-230Improper Handling of Missing ValuesThe product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.