CVE-2026-96432

Published: Ott 26, 2026 Last Modified: Ott 26, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,1
Source: a59d8014-47c4-4630-ab43-e1b13cbe58e3
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: active
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

476

NULL Pointer Dereference

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Execute Unauthorized Code Or Commands Read Memory Modify Memory
Applicable Platforms
Languages: C, C++, Java, C#, Go
Likelihood of Exploit: Medium
View CWE Details
https://codereview.qt-project.org/c/qt/qtbase/+/759718
https://codereview.qt-project.org/c/qt/qtbase/+/759718
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_prod…
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432: