An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5). It has been assigned the CVE ID CVE-2026-97845. Affected versions: from Qt 5.0.0 to Qt 6.8.9, from Qt 6.9.0 to Qt 6.11.2 Affected status unknown before Qt 5.0.0 Impact: An application that uses QXmlSimpleReader to parse a maliciously crafted XML document may crash, resulting in denial of service. Confidentiality and integrity are not affected. CVSS 4.0 Score: 4.3 / Medium Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/U:Green Mitigation: No workaround is available within QXmlSimpleReader. Until the fix is applied, avoid parsing XML from untrusted sources with QXmlSimpleReader. Solution: Apply the patches below, or update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.0 or later. Patches: dev: https://codereview.qt-project.org/c/qt/qt5compat/+/771290 https://codereview.qt-project.org/c/qt/qt5compat/+/774512 https://codereview.qt-project.org/c/qt/qt5compat/+/774513 https://codereview.qt-project.org/c/qt/qt5compat/+/774632 https://codereview.qt-project.org/c/qt/qt5compat/+/760219 https://codereview.qt-project.org/c/qt/qt5compat/+/760220 Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/774842 https://codereview.qt-project.org/c/qt/qt5compat/+/774858 https://codereview.qt-project.org/c/qt/qt5compat/+/774880 https://codereview.qt-project.org/c/qt/qt5compat/+/774881 https://codereview.qt-project.org/c/qt/qt5compat/+/774878 https://codereview.qt-project.org/c/qt/qt5compat/+/774889 or https://download.qt.io/archive/qt/6.11/CVE-2026-97845-qt5compat-6.11.zip Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774860 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774859 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774886 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774887 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774885 https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/774911 or https://download.qt.io/archive/qt/6.8/CVE-2026-97845-qt5compat-6.8.zip
Tero Pelkonen Qt Group Confidential
_______________________________________________ Announce mailing list [email protected] https://lists.qt-project.org/listinfo/announce
-- Development mailing list [email protected] https://lists.qt-project.org/listinfo/development
