Log in Start free

Vulnerability · Published Jul 23, 2026 · Assigned by TQtC

CVE-2026-15037XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Low 2.9

In plain English

A low-severity security flaw in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.9Low
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-baseno fix listedDEBIAN-CVE-2026-15037
Debian:13qt6-baseno fix listedDEBIAN-CVE-2026-15037
Debian:14qt6-base6.11.2+dfsg-6DEBIAN-CVE-2026-15037
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-15037
Debian:13qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-15037
Debian:14qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-15037
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-15037
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-15037
Ubuntu:26.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-15037
Ubuntu:26.10qt6-baseno fix listedUBUNTU-CVE-2026-15037
Ubuntu:26.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2026-15037
Ubuntu:26.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2026-15037

Affected products (as reported)

VendorProductVersions
Qt Qt 4.0.0 – before 6.12.0

Weakness: CWE-91 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References