Qt for MCUs EUVD-2026-92384

Exploitation requires that a Qt for MCUs application use a Text element configured to render styled/rich text (HTML-style markup) AND that the attacker be able to influence that text so it contains an <img> tag with an attribute whose value is empty. Limiting factors: the application must actually parse styled text (plain-text Text elements are unaffected), and exploitability hinges on whether that text is attacker-controllable and network-reachable - the AV:N rating assumes it is, but the description does not confirm the delivery path, so devices that render only trusted/static strings are not exposed. Impact is confined to a device halt (availability); no code execution, data disclosure, or integrity impact occurs.

This is an availability-only denial-of-service (device halt) issue, not a confidentiality or integrity flaw. The vendor CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity trigger with impact limited strictly to availability (VC:N/VI:N/VA:H), consistent with the CWE-617 reachable-assertion root cause: a styled-text <img> tag with an empty attribute value fails an internal non-empty check, and the default error handler halts the device. The E:U value in the vector indicates no proven/public exploit, and there is no EPSS score, no CISA KEV listing, and no POC provided in the input - so despite the 'network' attack vector, there is no evidence of real-world or automated exploitation. The practical risk is therefore moderate and conditional: it matters only where a Qt for MCUs application renders attacker-influenced styled text, and the single-value-only nature (device reset/halt rather than code execution or data exposure) plus the embedded, niche deployment footprint keep this below the priority of a typical remotely exploitable RCE. Note a labeling conflict: the input Tags include 'Information Disclosure,' which contradicts the CVSS impact metrics (VC:N, no confidentiality impact) - this appears to be a mislabeled tag and should not drive triage.

An attacker supplies styled/rich text containing an <img> tag with an empty attribute value (e.g. an empty src) to a Qt for MCUs application that renders it in a Text element; the parser hits the failed non-empty check and the default error handler halts the embedded device. No public exploit code is identified at time of analysis, and the vector marks exploit maturity as unproven. Realistic exploitability depends on whether the device renders attacker-controllable text.