Uncontrolled Recursion Vulnerability in Qt XML Parsing Functionality
CVE-2026-97845

4.3MEDIUM

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
12 November 2026

What is CVE-2026-97845?

An uncontrolled recursion vulnerability in the Qt QXmlSimpleReader XML parsing functionality can lead to denial of service or application crashes. This issue affects both the Qt XML module in Qt 5 and the Core Compatibility APIs in Qt 6, potentially allowing maliciously crafted XML documents to exploit the vulnerability, leading to stack overflow and subsequent application failure.

Affected Version(s)

qt 5.0.0 < 6.8.10

qt 6.9.0 < 6.11.3

References

https://www.qt.io/security-advisories?search=CVE-2026-97845
vendor-advisory
https://codereview.qt-project.org/c/qt/qt5compat/+/771290
patch
https://codereview.qt-project.org/c/qt/qt5compat/+/774512
patch

CVSS V4

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.