Type Confusion Vulnerability in Qt SVG Affects Multiple Versions

CVE-2026-6210

What is CVE-2026-6210?

A type confusion vulnerability in Qt SVG enables attackers to exploit SVG marker references, leading to application crashes. The vulnerability arises when an application retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node's type. If a non-marker element such as a references itself as a marker, it triggers an out-of-bounds heap read due to inconsistencies between object sizes, essentially causing an endless recursion and bypassing the marker recursion guard. This flaw results in a denial of service, impacting the stability of applications that utilize the affected versions.

References