Is CVE-2026-96432 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96432 being exploited in the wild.

How severe is CVE-2026-96432?

Informational severity, published 26 October 2026.

Which products and versions are affected?

Qt Group Qt 6.8.0 to 6.8.9, 6.9.0 to 6.11.2.

Is there a fix for CVE-2026-96432?

Yes: fixed in Qt 6.8.10, Qt 6.11.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96432 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96432?

Check whether you run Qt Group Qt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96432: Qt null pointer dereference in QNetworkAccessManager HTTP/2

CVE-2026-96432 · Severity: info · Published 2026-10-26

Qt Network's HTTP/2 implementation in QNetworkAccessManager can be crashed by a malicious or compromised HTTP/2 server. An attacker sends specific HTTP/2 protocol messages that cause a null pointer dereference, crashing any application that uses this library for network communication. This results in denial of service, making affected applications temporarily unavailable.

Technologies: Qt Group Qt. Vendors: Qt Group.

Quick answers

Is CVE-2026-96432 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96432 being exploited in the wild.
How severe is CVE-2026-96432?: Informational severity, published 26 October 2026.
Which products and versions are affected?: Qt Group Qt 6.8.0 to 6.8.9, 6.9.0 to 6.11.2.
Is there a fix for CVE-2026-96432?: Yes: fixed in Qt 6.8.10, Qt 6.11.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96432 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96432?: Check whether you run Qt Group Qt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Qt 6.8.10, Qt 6.11.3

Technical details

A malicious HTTP/2 server can craft a sequence of protocol messages—withholding SETTINGS ACK, then sending RST_STREAM on a completed stream followed by PUSH_PROMISE—that triggers a null pointer dereference in QNetworkAccessManager's HTTP/2 handling code. The vulnerability requires network connectivity to an attacker-controlled HTTP/2 server; no authentication, special privileges, or user interaction beyond normal application operation are needed. The result is a crash (denial of service) with no data disclosure or code execution.

Affected products

Qt Group Qt 6.8.0 to 6.8.9, 6.9.0 to 6.11.2

Timeline

2026-10-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.