CVE-2026-19395

Executive Summary

CVE-2026-19395 is a denial-of-service vulnerability in Qt for MCUs in which a Text element rendering styled text crashes or halts the device when an <img> tag embedded in that text carries an attribute with an empty value. The flaw resides in the text parser, which forwards the empty attribute value to an internal validation check that accepts only non-empty values; the check fails, an error is raised, and the default error handler halts the device. Any device or product built on an affected Qt for MCUs release that renders externally influenced styled text is potentially impacted with a full loss-of-availability condition.

Technical Analysis

Qt for MCUs is a graphics runtime for microcontroller-class devices. Its rich-text engine supports styled text, including inline <img> markup that references embedded images. According to the NVD description, the parser does not validate the contents of <img> attributes before passing attribute values into an internal check. When an attribute is present syntactically but carries an empty value, the parser extracts an empty string and forwards it to a check routine that is written to accept only non-empty values. That precondition is violated, the check returns a failure, and the failure is escalated to the default error handler — which, per the description, halts the device rather than degrading gracefully.

Two distinct weaknesses combine here:

1. Improper handling of a missing/empty value (CWE-230). The parsing path makes a value available to downstream logic without first confirming it is non-empty. The empty value is a legitimate, expected input in loosely authored or hostile markup, so the parser should either reject it with controlled error semantics or coerce it to a safe default.
2. Unsafe failure mode. The validation check's failure is routed into a default error handler whose defined behavior is to halt the device. In an embedded, often safety- or availability-relevant context, an unbounded halt caused by a single malformed token converts a parse-time input error into a hard denial of service that may require a physical reset or power cycle.

The CWE mapping confirms the root cause is value-handling rather than memory corruption: there is no indication in the source data of out-of-bounds access, use-after-free, or code execution. The vulnerability is a logic/validation defect whose severity is amplified by the runtime's error-handling policy.

Because Qt for MCUs is compiled into a product's firmware, the flaw is reachable anywhere an application renders styled text derived from a source the attacker can influence — for example, strings delivered over a device interface, network service, BLE, or serial channel and then passed to a Text element.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE; the attack chain below is inferred from the vulnerability class and the mechanism described in the NVD entry. No specific function names, class names, or code paths are asserted because none are provided in the source data.

1. Reconnaissance / target identification. An adversary identifies a target device or product running Qt for MCUs that (a) renders styled text via the rich-text Text element and (b) accepts text content from a channel the attacker can reach — a device UI with an editable text field, a companion mobile/web app, a network API, or an update/config channel that stores text later displayed on the micro-controller display.
2. Triggering the flaw. The attacker supplies a styled-text string containing an <img> tag whose attribute carries an empty value (for example, an attribute written with nothing after the equals sign). The parsers' downstream check, which only accepts non-empty values, fails on the empty string.
3. Payload / delivery. Delivery is simply the malicious string reaching the text-rendering path; no memory-corruption payload is needed. The "payload" is the malformed markup token itself, which can be embedded in otherwise valid rich text to avoid superficial suspicion.
4. Post-exploitation impact. The failed check is reported to the default error handler, which halts the device. The attacker achieves an immediate, repeatable denial of service using a single crafted text value; if the text is persisted (e.g., stored in device config, a log, or a remote profile), the device may re-halt on every boot or redraw — a persistent, low-effort availability attack requiring physical intervention to clear.

Impact Assessment

Impact is confined to availability. On successful triggering, the device halts and ceases to perform its function until reset; there is no evidence of confidentiality or integrity impact, nor of code execution. Because the flaw sits in a shared Qt for MCUs text-rendering component, the blast radius spans any product line built on the affected runtime that processes attacker-influenced styled text — a multi-tenant risk for OEMs shipping multiple device models from one firmware base. CVSS score and vector are not available (NVD: N/A), consistent with an unenriched, recently assigned CVE. In practice, an unauthenticated or low-privilege input path to a Text element, combined with a hard halt and possible persisting re-trigger, warrants treating this as a meaningful denial-of-service concern for embedded and IoT deployments, particularly where remote restart or field service is costly.

Detection Guidance

Detection focuses on the characteristic markup token (an <img> tag with an empty attribute value) flowing through text-ingestion channels, and on abnormal device halts.

Sigma Rule

title: Potential Qt for MCUs Styled Text DoS - Empty img Attribute Value
id: 8f2c1b47-0a3d-4c9e-9b21-7c5a6d193950
status: experimental
description: Detects styled text containing an <img> tag with an empty attribute value, the pattern described in CVE-2026-19395 for Qt for MCUs devices.
logsource:
  category: application
  product: custom
detection:
  selection_keyword:
    - '<img'
  selection_empty_attr:
    - '<img src=""'
    - '<img =""'
    - '<img src= >'
    - '<img src =""'
  condition: selection_keyword and selection_empty_attr
falsepositives:
  - Legitimate misconfigured templates
  - QA test data
level: medium
tags:
  - attack.t1203
  - cve.2026.19395

YARA Rule

rule CVE_2026_19395_Qt_MCU_Empty_Img_Attr
{
    meta:
        description = "Detects styled-text payloads with an <img> tag carrying an empty attribute value targeting Qt for MCUs (CVE-2026-19395)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19395"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $img = "<img" ascii nocase
        $eq  = "=\"" ascii
        $qt  = "Qt for MCUs" ascii nocase
    condition:
        $img and $eq
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19395 Qt for MCUs Styled Text DoS Attempt (empty img attribute)"; flow:established,to_server; content:"<img"; nocase; http_client_body; pcre:"/<img[^>]*\s[a-zA-Z0-9_:-]+\s*=\s*(\"\"|\'\'|\s*>)/i"; reference:cve,2026-19395; classtype:attempted-dos; sid:202619395; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [process where event.type == "start" and process.args : "*<img*"]
  [any where event.category == "process" and process.name : ("watchdog*", "init*", "systemd*")]

Splunk SPL Query

index=embedded OR index=device_logs
| search ("<img" AND ("src=\"\"" OR "<img >" OR "<img=\"\""))
| stats count by host, source, _raw
| where count > 0

Wazuh OSSEC Rule

<group name="qt_mcus,cve-2026-19395,">
  <rule id="2026193" level="10">
    <decoded_as>json</decoded_as>
    <match><img</match>
    <regex type="pcre2">src\s*=\s*(\"\"|'')</regex>
    <description>CVE-2026-19395: Styled text with empty img attribute value detected (Qt for MCUs DoS)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Where possible, upstream sanitize all text before it reaches a Qt for MCUs Text element: strip or reject <img> tags with empty attribute values and validate rich-text markup against an allow-list. If the runtime exposes an application-installable error handler, replace the default halting behavior with a non-fatal handler that logs and continues. Where text input is user-supplied, validate on both the sending application and the device side.
2. Patch/upgrade steps. No vendor fix or fixed version is available from any tracked source. Monitor the Qt for MCUs advisory/release channels for either a runtime update that tolerates empty attribute values or a change to the error handler. Until a fix ships, apply the mitigations above.
3. Long-term hardening. Treat rich-text markup as untrusted input by default in embedded graphics pipelines; enforce canonicalization and schema validation on all externally sourced strings; design error handlers so a single malformed token can never escalate to a hard device halt; add resource/watchdog supervision so a parser fault cannot render a device permanently unavailable; and track Qt for MCUs CVEs as part of embedded supply-chain monitoring.

References

1. NVD — CVE-2026-19395: https://nvd.nist.gov/vuln/detail/CVE-2026-19395
2. CWE-230 — Improper Handling of Missing Values: https://cwe.mitre.org/data/definitions/230.html
3. Qt for MCUs product and security information: https://www.qt.io/product/qt-for-mcus
4. MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-19395 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or exploit-in-the-wild evidence is currently associated with CVE-2026-19395.