Qt Issues Security Patches for NTLM Authentication Vulnerability
Qt has released urgent patches for an out-of-bounds read vulnerability in its NTLM authentication module affecting multiple versions of the Qt 6 framework.
Qt published a security advisory on October 27, 2026, for CVE-2026-105946. This vulnerability is an out-of-bounds read in NTLM authentication within the Qt Network module, affecting apps using QNetworkAccessManager or QTcpSocket for NTLM authentication, including proxy scenarios.
CVSS 4.0 rates the flaw 5.3 Medium, with vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P. It features network reachability, low attack complexity, required user interaction, no required privileges, and high confidentiality and availability impact.
A malicious server or proxy requesting NTLM authentication triggers the out-of-bounds read, exposing heap memory contents or crashing the application.
Affected version ranges include Qt 6.8.0 through 6.8.9 and Qt 6.9.0 through 6.11.1. Statuses for releases before 6.8.0 remain unknown.
There is no workaround. You must restrict NTLM authentication to trusted servers and proxies until patched.
Update to Qt 6.11.2, Qt 6.8.10, Qt 6.12.0, or later. If you cannot upgrade, apply patches via the Qt project's code review system or download diff files for the 6.11 and 6.8 branches from Qt servers. Patches exist for dev, Qt 6.11, and Qt 6.8 branches.
Two other advisories accompanied this release on October 27, 2026: CVE-2026-107590, an out-of-bounds write in QTextCodec's iconv-based encoding, and CVE-2026-107472, an out-of-bounds read in QTextCodec's TSCII encoding.