An out-of-bounds read vulnerability in the Qt NTLM authentication handling of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-105946. Applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM, including through a proxy, are affected.

Affected versions: from Qt 6.8.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.1

Affected status unknown before Qt 6.8.0

Impact: A malicious server or proxy that requests NTLM authentication can cause the application to read outside the bounds of an allocated buffer. This may disclose application heap memory contents to the remote party and may cause the application to terminate.

CVSS 4.0 Score: 5.3 / Medium

Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Mitigation: No workaround is available.…