Improper Output Neutralization in Qt XML by The Qt Company
CVE-2026-15037

2.9LOW

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
23 July 2026

What is CVE-2026-15037?

A vulnerability exists in the Qt XML component due to improper output neutralization during serialization processes such as QDom comments and CDATA sections. This flaw permits the injection of arbitrary XML markup through untrusted text, as node terminators are inadequately escaped when adhering to the default InvalidDataPolicy (AcceptInvalidChars). The issue affects various versions of Qt XML, specifically from 4.0.0 to 6.11, and has been addressed in Qt version 6.12.

Affected Version(s)

Qt 4.0.0 < 6.12.0

References

https://codereview.qt-project.org/c/qt/qtbase/+/748323
patch

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.