Qt Network EUVD-2026-109779

Exploitation requires a Qt-based application that uses QNetworkAccessManager to make HTTP/2 requests, and that application must connect to an HTTP/2 server the attacker controls or has compromised (UI:A - the victim client must initiate the connection). The attacker must then orchestrate a specific frame sequence: withhold the SETTINGS ACK, send RST_STREAM on an already-completed stream to plant a null pointer, and send a PUSH_PROMISE for that stream. Affected builds are Qt 6.8.0-6.8.9 and 6.9.0-6.11.2. Limiting factors that reduce realistic risk: the attacker cannot reach an arbitrary victim unsolicited - the client must choose to connect to the malicious/compromised endpoint; HTTP/2 must be in use; and the sole outcome is an application crash (denial of service), with no code execution, data disclosure, or integrity impact.

All signals point to a low real-world priority. The supplied CVSS 4.0 score is 2.1 and the vector (AV:N/AC:L/AT:P/PR:N/UI:A) shows the only impact is availability (VA:H; VC:N/VI:N) - a crash, not code execution or data exposure. The threat metrics reinforce low urgency: E:U marks exploitation as unproven/unreported, and the vuln.today Decision label is 'monitor', not act_now or emergency. No CISA KEV listing is present and no POC or exploit reference appears in the input, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in - that is a missing signal rather than a low one. The one factor that modestly raises exposure is that Qt is a very widely deployed framework, but exploitation still requires the victim's application to connect to an attacker-controlled or compromised HTTP/2 server, and the worst outcome is a denial of service. Net: a genuine but low-severity client-side DoS; patch on a normal maintenance cadence rather than as an emergency.

An attacker who operates or has compromised an HTTP/2 server waits for a Qt-based client application (using QNetworkAccessManager over HTTP/2) to connect, then sends a crafted frame sequence - withholding the SETTINGS ACK, issuing RST_STREAM on an already-completed stream to plant a null pointer, then sending a PUSH_PROMISE for that stream - triggering a null pointer dereference that crashes the client. No public exploit is identified at time of analysis, and the impact is limited to denial of service (a crash) against the connecting application; there is no confidentiality or integrity effect.