CVE-2026-82292 - Vulnerability Details - OpenCVE

ReportizFlow

A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qt	Qt Qt Framework Qtbase

No data.

No data.

References

Link	Providers
https://codereview.qt-project.org/c/qt/qtbase/+/757771
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:

History

Fri, 13 Nov 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Qt qt Framework
Vendors & Products		Qt qt Framework

Thu, 12 Nov 2026 07:45:00 +0000

Type	Values Removed	Values Added
Description		A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).
Title		NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt
First Time appeared		Qt Qt qt Qt qtbase
Weaknesses		CWE-476
CPEs		cpe:2.3:a:qt:qt:::::::: cpe:2.3:a:qt:qtbase::::::::
Vendors & Products		Qt Qt qt Qt qtbase
References		https://codereview.qt-project.org/c/qt/qtbase/+/757771 https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:
Metrics		cvssV4_0 `{'score': 1.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L'}`

MITRE

Status: PUBLISHED

Assigner: Qt

Published: 2026-11-12T07:27:16.949Z

Updated: 2026-11-12T07:27:16.949Z

Reserved: 2026-08-28T11:25:30.712Z

Link: CVE-2026-82292

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-11-12T08:16:42.167

Modified: 2026-11-12T21:30:23.870

Link: CVE-2026-82292

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82292", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-08-28T11:25:30.712Z", "datePublished": "2026-11-12T07:27:16.949Z", "dateUpdated": "2026-11-12T07:27:16.949Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-11-12T07:27:16.949Z"}, "title": "NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "affected": [{"vendor": "qt", "product": "qt", "modules": ["qtbase"], "versions": [{"status": "affected", "version": "4.1.0", "lessThan": "6.8.9", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThan": "6.11.3", "versionType": "python"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"]}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndExcluding": "6.11.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndExcluding": "6.11.3"}]}]}], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A NULL pointer dereference vulnerability in the Qt Framework <code>QDomDocument::setContent()</code> XML parsing path of the Qt XML module (qtbase).</p>"}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtbase/+/757771", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L"}}], "credits": [{"lang": "en", "value": "Albert Astals Cid from KDE", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["qtbase"], "product": "qt", "vendor": "qt", "versions": [{"lessThan": "6.8.9", "status": "affected", "version": "4.1.0", "versionType": "python"}, {"lessThan": "6.11.3", "status": "affected", "version": "6.9.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase)."}], "id": "CVE-2026-82292", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}, "published": "2026-11-12T08:16:42.167", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtbase/+/757771"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}