Qt QNetworkAccessManager CVE-2026-95620

Exploitation requires the victim's Qt application to use QNetworkAccessManager's HTTP/2 client support and to establish an HTTP/2 connection to a server the attacker controls or has compromised - the server, not the attacker directly, delivers the malicious HTTP/2 traffic. Consistent with CVSS UI:A, active user/application interaction is needed to initiate that outbound connection, and AC:H/AT:P indicate further conditions outside the attacker's control must be met, so this cannot be triggered against a passive or default client without an outbound HTTP/2 session to a hostile endpoint. Limiting factors: no authentication is bypassed and no server-side exposure exists (this is a client-side flaw); impact is restricted to a crash of the client process with no code execution, data disclosure, or integrity impact described in the available sources. The precise memory-management trigger within the HTTP/2 client is not described in the available sources.

All signals converge on LOW real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H) yields a base score of only 2.1, and the impact is confined to availability (VA:H) with no confidentiality or integrity effect - consistent with the description, which states the flaw merely crashes the client application. Exploitation maturity is E:U (unproven) and the vuln.today decision label is 'monitor', not act_now or emergency. This is NOT in CISA KEV (no active exploitation), no EPSS score was provided, and the only references are a vendor advisory and a Gerrit patch - there is no PoC or exploit reference, so no public exploit is identified. The combination AC:H + AT:P + UI:A means the attacker must induce a victim client to connect to an attacker-controlled or compromised HTTP/2 server AND additional execution conditions outside the attacker's control must hold, which is why the score is low despite the network vector. This is a genuine but low-risk availability bug, not a high-CVSS-but-overrated issue - it is correctly rated low across the board. No conflicting signals were found; the main gap is the absence of EPSS data to quantify exploitation probability.

A user's Qt-based application initiates an HTTP/2 connection to a server that is attacker-controlled or has been compromised. The malicious server returns crafted HTTP/2 responses that trigger a use-after-free in QNetworkAccessManager's HTTP/2 client code, crashing the client. No public exploit code or PoC reference is provided, and the impact is limited to a denial of service of the client application.