A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

The version of Qt installed on the remote host is 6.8.x prior to 6.8.10, or 6.9.0 or later prior to 6.11.3.
It is, therefore, affected by multiple vulnerabilities:

  - A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed     stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer     dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
    (CVE-2026-96432)

  - A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in     VectorImage QML Type. (CVE-2026-105923)

  - Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt     Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial     of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an     application using QNetworkAccessManager or QTcpSocket authenticates with NTLM. (CVE-2026-105946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in
    VectorImage QML Type. (CVE-2026-105923)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in     VectorImage QML Type. (CVE-2026-105923)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374146	Qt 6.8.x < 6.8.10 / 6.9.0 < 6.11.3 Multiple Vulnerabilities	Nessus	Misc.	Local	medium
477729	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e8	Tenable Cloud Security	Echo Local Security Checks	Local	medium
477729	Echo: qtbase-opensource-src: security update to 5.15.15+dfsg-6+e8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
370038	Linux Distros Unpatched Vulnerability : CVE-2026-105923	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-105923

medium

Tenable Plugins

medium

medium

medium

medium