A crafted XML document supplied to an application that parses XML with Qt's QXmlStreamReader can cause the parser to consume an excessive amount of CPU time, making the application process unresponsive. The exploit achieves only a denial of service; there is no data loss, disclosure, modification, or code execution. The impact is confined to the process that performs the parsing and does not affect other system components.

The vulnerability affects Qt applications that use the Qt Core QXmlStream parser, specifically the Qt and Qtbase components identified by the vendor qt:qt. No specific version information is provided, so any installation that incorporates QXmlStreamReader is potentially susceptible.

The CVSS score of 8.7 indicates a high severity vulnerability, and the EPSS score is not available, meaning no publicly reported exploitation data is known. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker who can provide XML input to the parser—such as through network interfaces, file uploads, or other user-supplied data—can trigger the denial of service. No special privileges or authentication are required, so the exploit can affect any user or process that parses untrusted XML.