Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 4

Vulnerabilities 4

• High 8.8
  CVE-2026-95509

  Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs

  Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

  Qt Project Qt for MCUs
  Sep 29, 2026
• Medium 5.3
  CVE-2026-105946

  Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt

  Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM ch…

  Qt Project Qt qtbase-opensource-src qtbase-opensource-src Debian Ubuntu Azure Linux
  Oct 27, 2026
• Medium 4.3
  CVE-2026-111487

  Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt Framework

  An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

  Qt Project Qt Framework qt6-3d qt3d-opensource-src Debian Ubuntu
  Oct 30, 2026
• Low 2.1
  CVE-2026-96432

  Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

  A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt…

  Qt Project Qt qt6-base qt6-base Debian Ubuntu
  Oct 26, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-95509
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-96432
• report
  https://access.redhat.com/security/cve/CVE-2026-105946
• report
  https://access.redhat.com/security/cve/CVE-2026-111487
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80566.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2543059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-95509
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-95509
• article
  https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95509:
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2560835
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96432
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96432
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/759718
• article
  https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432:
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2561557
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-105946
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-105946
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/744448
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/745457
• article
  https://codereview.qt-project.org/c/qt/qtbase/+/745464
• article
  https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105946:
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2564104
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-111487
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-111487
• article
  https://codereview.qt-project.org/c/qt%2Fqt3d/+/777981
• article
  https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-111487
• article
  https://www.qt.io/blog/security-advisory-cve-2026-111487