CVE-2026-19395: CWE-617 Reachable assertion in qt Qt for MCUs

In Qt for MCUs versions >=2.12.0 and <2.12.3, a reachable assertion vulnerability exists due to the handling of styled text in a Text element. Specifically, if an <img> tag within the text contains an attribute with an empty value, the text parser passes this empty value to an internal check that only accepts non-empty values. The check fails, causing an error that invokes the default error handler, which halts the device. This is classified under CWE-617 (Reachable Assertion) and CWE-230 (Improper Handling of Exceptional Conditions).

The vulnerability causes the device running Qt for MCUs to halt unexpectedly when processing styled text containing an <img> tag with an empty attribute value. This results in a denial of service condition. There is no indication of privilege escalation, data leakage, or remote code execution. The CVSS 4.0 base score is 6.6 (medium severity), reflecting network attack vector with no privileges or user interaction required, but with high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using styled text with <img> tags that contain attributes with empty values in Qt for MCUs versions >=2.12.0 and <2.12.3 to prevent device halting.