HackZoneLabs News
Newsletter

CVE-2026-82292

NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt

  • Low 1.9

Description

A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).

Key facts

Published
12 Nov 2026
Last changed
12 Nov 2026
Assigned by
Qt
EPSS
0.12% likely to be exploited in the next 30 days, higher than 1.862% of CVEs (scores for 15 Nov 2026)

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 1.9CVSS 4.0, Lowfrom the CNA (Qt)CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-153 Input Data Manipulation (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
qtqt
  • Default status: unaffected
  • 4.1.0 up to but excluding 6.8.9 (affected)
  • 6.9.0 up to but excluding 6.11.3 (affected)

Timeline

  1. 12 Nov 2026 Published

Weakness

References