A denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) of the qtbase component has been discovered and has been assigned the CVE id CVE-2026-16762. Affected versions: from Qt 4.3.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1. QtXml / QDomDocument is not affected by this issue. Affected status unknown before Qt 4.3.0. Impact: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process. CVSS 4.0 Score: 8.7 / HIGH Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Mitigation: Validate and size-limit untrusted XML before parsing (cap input size and attribute count at the ingress point) and enforce parse timeouts. Do not parse attacker-controlled XML in-process without such limits. Solution: Apply the patches below, or update to Qt 6.8.9, Qt 6.11.2, Qt 6.12.0 or later. Patches: dev: https://codereview.qt-project.org/c/qt/qtbase/+/738885 and https://codereview.qt-project.org/c/qt/qtbase/+/738901 Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/746368 and https://codereview.qt-project.org/c/qt/qtbase/+/746369 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-16762-qtbase-6.11-0001.diff and https://download.qt.io/official_releases/qt/6.11/CVE-2026-16762-qtbase-6.11-0002.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/746715 and https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/746717 or https://download.qt.io/archive/qt/6.8/CVE-2026-16762-qtbase-6.8-0001.diff and https://download.qt.io/archive/qt/6.8/CVE-2026-16762-qtbase-6.8-0002.diff
Tero Pelkonen Qt Group Confidential
_______________________________________________ Announce mailing list [email protected] https://lists.qt-project.org/listinfo/announce
-- Development mailing list [email protected] https://lists.qt-project.org/listinfo/development
