Qt Core: Denial of service in QXmlStreamReader XML parser
Summary
The XML parser QXmlStreamReader in Qt Core can consume disproportionate CPU time when it parses a specially crafted XML document. An attacker who can supply XML to a Qt-based application can make it unresponsive. No authentication or user interaction is needed beyond the application ingesting the input, and the impact is limited to availability. The CNA rates the CVSS 4.0 score at 8.7, while VulDB rates it at 5.3 (medium).
Affected
- Qt from 4.3.0 before 6.8.9
- Qt from 6.9.0 before 6.11.2
- Versions before 4.3.0: unclear (sources conflict)
- Qt 5.x: not mentioned in the CNA ranges, status unknown
- Applications built on Qt that parse XML are affected through the Qt library
Fixed in
- Qt 6.8.9
- Qt 6.11.2
- Verify exact fixed builds against the Qt advisory before acting
Workaround
- No vendor-specific workaround found
- Interim measures (own suggestion, not from a vendor source): limit the size of XML accepted from untrusted sources, reject or quarantine unexpected documents, and run XML-processing services under a supervisor that restarts them after a crash
Exploitation
- Not known to be exploited; not listed in CISA KEV as far as the research found
- No public proof of concept found (not exhaustively searched)
- EPSS about 0.4 to 0.5 percent probability of exploitation within 30 days (per mirrors)
- CISA SSVC: exploitation none, automatable yes, technical impact partial
Our recommendation
- Identify which installed applications use Qt, especially those that accept XML from external parties (web uploads, APIs, third-party feeds, email attachments)
- Upgrade Qt to 6.8.9 or 6.11.2 or later where you build or maintain the software
- Ask software vendors for patched builds and prioritise internet-facing or externally fed applications
- Monitor application availability and restart failed XML-processing services
- Internal desktop tools that only read trusted local files are low priority
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Qt blog security advisory www.qt.io
- Qt known vulnerabilities list wiki.qt.io
- Gerrit patch 738885 codereview.qt-project.org
- Gerrit patch 738901 codereview.qt-project.org
- VulDB CVE-2026-16762 vuldb.com
- Ubuntu security notice ubuntu.com
- OffSeq threat radar radar.offseq.com
- Vulners NVD record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:32.
Original description (NVD)
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.