Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by Qt

CVE-2026-16762Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

High 8.7

In plain English

A high-severity security flaw in qt from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-baseno fix listedDEBIAN-CVE-2026-16762
Debian:13qt6-baseno fix listedDEBIAN-CVE-2026-16762
Debian:14qt6-base6.11.2+dfsg-5DEBIAN-CVE-2026-16762
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-16762
Debian:13qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-16762
Debian:14qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-16762
Debian:12qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-16762
Debian:13qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-16762
Debian:14qtbase-opensource-src-glesno fix listedDEBIAN-CVE-2026-16762
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-16762
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-16762
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-16762
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2026-16762

Affected products (as reported)

VendorProductVersions
qt qt 4.3.0 – before 6.8.96.9.0 – before 6.11.2

Weakness: CWE-407 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L

References