Qt Network EUVD-2026-110615

Exploitation requires that the target application is built on the Qt Network module AND actually uses NTLM authentication through QNetworkAccessManager or QTcpSocket - applications that do not use NTLM are not exposed. The attacker must control, impersonate, or be on-path for the server or proxy the application authenticates against, so that it can return a crafted NTLM challenge message; the application must itself initiate that authentication (UI:A / AT:P), meaning the attacker cannot trigger it against a passive target. No attacker-side authentication is required (PR:N). Limiting factors: NTLM is not used by all Qt applications, the victim must be steered to a malicious/compromised endpoint, and only Qt 6.8.0-6.8.9 and 6.9.0-6.11.1 are affected (fixed in 6.8.10 and 6.11.2).

This is a moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The vendor CVSS 4.0 base score is 5.3 (medium): AV:N and AC:L make the trigger network-reachable and low-complexity once conditions are met, but AT:P (attack requirements present) and UI:A (active user/application interaction) capture that the victim application must itself initiate NTLM authentication against an attacker-controlled server or proxy - the flaw cannot be fired at an arbitrary target unsolicited. Impact is confidentiality-and-availability only on the vulnerable system (VC:H heap memory disclosure, VA:H application crash; VI:N, no integrity, no scope change). EPSS is low at 0.46% (39th percentile), indicating no broad mass-exploitation pressure, and the issue is NOT on CISA KEV, so there is no public active exploitation. The vuln.today decision label is this_month, consistent with 'patch in the normal cycle,' not act_now/emergency. One nuance to flag explicitly: the CVSS 4.0 vector carries E:P (proof-of-concept exploit maturity), yet the supplied references contain only the Qt advisory and three patch code-review links - no PoC or exploit reference is provided - so the E:P metric is not corroborated by any exploit artifact in this input and should be treated as unverified. Net: a genuine information-disclosure/DoS bug worth patching, but its reach is gated by whether an application actually uses NTLM and can be steered to a malicious server.

A Qt-based application that performs NTLM authentication via QNetworkAccessManager or QTcpSocket is induced to connect to an attacker-controlled HTTP server or proxy (or an on-path/MITM position). The malicious endpoint returns a crafted NTLM type-2 challenge message that triggers the out-of-bounds read in QAuthenticator, causing the application to disclose adjacent heap memory contents to the server or crash. No public exploit reference is provided in the available sources; the CVSS vector lists proof-of-concept maturity but this is not corroborated by any supplied PoC.