An out-of-bounds read vulnerability in the Qt NTLM authentication handling of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-105946. Applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM, including through a proxy, are affected.
Affected versions: from Qt 6.8.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.1
Affected status unknown before Qt 6.8.0
Impact: A malicious server or proxy that requests NTLM authentication can cause the application to read outside the bounds of an allocated buffer. This may disclose application heap memory contents to the remote party and may cause the application to terminate.
CVSS 4.0 Score: 5.3 / Medium
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Mitigation: No workaround is available. Until the update or patches are applied, users can reduce exposure by allowing NTLM authentication only towards trusted servers and proxies.
Solution: Update to Qt 6.11.2, Qt 6.8.10 or Qt 6.12.0 or later, or apply the following patches.
Patches:
dev:
https://codereview.qt-project.org/c/qt/qtbase/+/745457
https://codereview.qt-project.org/c/qt/qtbase/+/744448
https://codereview.qt-project.org/c/qt/qtbase/+/745464
Qt 6.11:
https://codereview.qt-project.org/c/qt/qtbase/+/746630
https://codereview.qt-project.org/c/qt/qtbase/+/746626
https://codereview.qt-project.org/c/qt/qtbase/+/746632
or
https://download.qt.io/official_releases/qt/6.11/CVE-2026-105946-qtbase-6.11-0001.diff
https://download.qt.io/official_releases/qt/6.11/CVE-2026-105946-qtbase-6.11-0002.diff
https://download.qt.io/official_releases/qt/6.11/CVE-2026-105946-qtbase-6.11-0003.diff
Qt 6.8:
https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/775946
https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/775958
https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/775969
or
https://download.qt.io/archive/qt/6.8/CVE-2026-105946-qtbase-6.8-0001.diff
https://download.qt.io/archive/qt/6.8/CVE-2026-105946-qtbase-6.8-0002.diff
https://download.qt.io/archive/qt/6.8/CVE-2026-105946-qtbase-6.8-0003.diff
