{"id":"CVE-2026-105946","aliases":[],"title":"Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt","titleSource":"Qt","descriptionSource":"Qt","products":[{"vendor":"qt","name":"qt","platforms":[],"versions":[{"version":"0","status":"unknown","lessThan":"6.8.0","versionType":"python"},{"version":"6.8.0","status":"affected","lessThan":"6.8.10","versionType":"python"},{"version":"6.9.0","status":"affected","lessThan":"6.11.2","versionType":"python"}],"defaultStatus":"unaffected","source":"Qt","url":"https://www.cve.org/CVERecord?id=CVE-2026-105946"}],"remediation":[],"description":"Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.","severity":"medium","score":5.3,"published":"2026-10-27T06:45:36.400Z","modified":"2026-10-27T06:45:36.400Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105946:","https://codereview.qt-project.org/c/qt/qtbase/+/745457","https://codereview.qt-project.org/c/qt/qtbase/+/744448","https://codereview.qt-project.org/c/qt/qtbase/+/745464"],"sources":[{"name":"CVE","id":"CVE-2026-105946","modified":"2026-10-27T06:45:36.400Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-105946"}],"assessments":[{"source":"Qt","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":5.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:10:31.402Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}