CVE-2026-19395

A flaw was found in Qt for MCUs. When processing styled text in a Text element, the text parser improperly handles an image (<img>) tag containing an attribute with an empty value. An attacker can exploit this issue by supplying specially crafted styled text, causing an internal validation check to fail and triggering the error handler to halt the device, resulting in a Denial of Service (DoS).

Red Hat Product Security has rated this vulnerability as having an Important severity because an unauthenticated remote attacker could trigger a complete denial of service leading to a device halt when processing untrusted markup. This flaw is specific to the Qt for MCUs framework designed for microcontroller targets. Standard Qt packages distributed across Red Hat products do not include this microcontroller-specific codebase and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.