Skip to content
Advisories.
qt-group-plcCVE-2026-79680

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module.

Medium4.5CVE-2026-79680 · Published Sep 24, 2026

Source advisory

Affected versions

PackageAffectedFixed in
qt
Vendor
>= 6.4.0, < 6.8.96.8.9
>= 6.9.0, < 6.11.36.11.3
Details and references

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:X
Severity from
no source yet
Weakness
CWE-288

More qt-group-plc advisories

All
DateAdvisory
Sep 23Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
CVE-2026-78253Low2.3no fix yet
Sep 23Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.
CVE-2026-79616Low0.6no fix yet
Sep 16Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.
CVE-2026-76151Medium4.6fixed in qt 6.8.9, qt 6.11.2
Sep 16QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
CVE-2026-19248High7.1no fix yet
Sep 11An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag.
CVE-2026-13326Medium6.9fixed in qt 6.8.9, qt 6.11.2
Sep 8Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase).
CVE-2026-11573High7.1fixed in qt 6.8.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.