NULL Pointer Dereference in Qt Framework's XML Module
CVE-2026-82292

1.9LOW

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
12 November 2026

What is CVE-2026-82292?

A NULL pointer dereference vulnerability exists in the QDomDocument::setContent() function within the Qt Framework's XML module, potentially allowing an attacker to exploit the XML parsing process, which can lead to unexpected behavior or application crashes.

Affected Version(s)

qt 4.1.0 < 6.8.9

qt 6.9.0 < 6.11.3

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt/qtbase/+/757771
patch

CVSS V4

Score:
1.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Albert Astals Cid from KDE
.