Is CVE-2026-82292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82292 being exploited in the wild.

How severe is CVE-2026-82292?

Informational severity, published 12 November 2026.

Which products and versions are affected?

Qt Framework 4.1.0 to 6.8.8, 6.9.0 to 6.11.2.

Is there a fix for CVE-2026-82292?

Yes: fixed in Qt 6.8.9, Qt 6.11.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82292 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82292?

Check whether you run Qt Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82292: Qt Framework NULL pointer dereference in QDomDocument XML parsing

CVE-2026-82292 · Severity: info · Published 2026-11-12

Qt Framework, a widely-used cross-platform application development toolkit, contains a NULL pointer dereference vulnerability in its XML parsing component (QDomDocument). When parsing XML with invalid characters while a specific error handling policy is set, the application crashes, causing denial of service. There is no exposure of data or system compromise.

Technologies: Qt Framework. Vendors: Qt.

Quick answers

Is CVE-2026-82292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82292 being exploited in the wild.
How severe is CVE-2026-82292?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Qt Framework 4.1.0 to 6.8.8, 6.9.0 to 6.11.2.
Is there a fix for CVE-2026-82292?: Yes: fixed in Qt 6.8.9, Qt 6.11.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82292 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82292?: Check whether you run Qt Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Qt 6.8.9, Qt 6.11.3

Technical details

A NULL pointer dereference occurs in QDomDocument::setContent() when parsing XML containing characters invalid under XML 1.0 with invalidDataPolicy set to QDomImplementation::ReturnNullNode. The document node factory returns a null node, which the DOM builder then dereferences without validation. An attacker who can provide malformed XML input to an application triggers the crash.

Affected products

Qt Qt Framework 4.1.0 to 6.8.8, 6.9.0 to 6.11.2

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.