Uncontrolled Recursion Vulnerability in Qt's QDomDocument Serialization
CVE-2026-11573

7.1HIGH

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
8 September 2026

What is CVE-2026-11573?

The vulnerability present in Qt's QDomDocument serialization within the QtXml module allows for uncontrolled recursion, which can be triggered by deeply nested untrusted XML input. This leads to application crashes due to stack exhaustion, resulting in a denial of service. Developers using this component must validate XML inputs to prevent such recursive parsing issues.

Affected Version(s)

qt 6.7.0 < 6.8.2

References

https://codereview.qt-project.org/c/qt/qtbase/+/606899
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.