{"id":"CVE-2026-96432","aliases":[],"title":"Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt","titleSource":"Qt","descriptionSource":"Qt","products":[{"vendor":"qt","name":"qt","platforms":[],"versions":[{"version":"6.8.0","status":"affected","lessThanOrEqual":"6.8.9","versionType":"python"},{"version":"6.9.0","status":"affected","lessThanOrEqual":"6.11.2","versionType":"python"}],"defaultStatus":"unaffected","source":"Qt","url":"https://www.cve.org/CVERecord?id=CVE-2026-96432"}],"remediation":[],"description":"A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.","severity":"low","score":2.1,"published":"2026-10-26T11:31:20.304Z","modified":"2026-10-26T14:35:18.098Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432:","https://codereview.qt-project.org/c/qt/qtbase/+/759718"],"sources":[{"name":"CVE","id":"CVE-2026-96432","modified":"2026-10-26T14:35:18.098Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96432"}],"assessments":[{"source":"Qt","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:L/U:Green","score":2.1}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:10:35.950Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}