Qt VNC Server EUVD-2026-85846

Exploitation requires (1) a reachable instance of the Qt VNC Server module actively sharing an application session, (2) that instance configured to use Qt VNC Server's built-in password authentication (the mechanism being bypassed), and (3) an attacker-controlled VNC client modified to violate the RFB protocol during the handshake. The CVSS AT:P and UI:A metrics indicate the attack depends on an active/shared session condition rather than working against an idle default, which is the primary limiting factor; no valid credentials are needed (PR:N). Impact is confined to the shared application session (VC:H/VI:H) with no availability effect (VA:N).

This is a genuine but conditional MEDIUM-risk flaw, not a drop-everything priority. The Qt-supplied CVSS 4.0 base score is 4.5, and the vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) indicates a remote, unauthenticated attack with high confidentiality and integrity impact but no availability impact. Two factors deliberately hold the score down: AT:P signals a specific attack requirement (an active, shared VNC session the attacker can reach), and the temporal metric E:U (Exploit Unproven) reflects that no working exploit is known - consistent with the absence of any POC. There is no EPSS score and no CISA KEV listing, so there is no external signal of active or automated exploitation; SSVC-style reasoning would put exploitation at 'none' and automatable at 'no' given the required active session and bespoke protocol-violating client. In short: a real authentication-bypass primitive with high per-session impact, but gated by a non-trivial precondition and no evidence of exploitation in the wild. The base score comes from the vendor's own 4.0 assessment; note the 4.5 figure blends in the E:U temporal downgrade, so the underlying base severity of an auth bypass yielding VC:H/VI:H is effectively higher than 4.5 suggests - treat the number cautiously.

An attacker on the network points a specially modified VNC client at a device running Qt's VNC Server, sending RFB handshake messages that deviate from the protocol to skip the password-authentication step entirely. With authentication bypassed, the attacker gains view-and-control access to the shared Qt application, reading its displayed data and injecting input. No public exploit code is currently identified, and the attack requires an active shared session to target.