Description
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Published: 2026-09-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A parsing bug in Qt's QDomNode destructor causes unbounded recursion when handling malformed XML. The bug results from an uncontrolled recursion weakness (CWE-674) and a destructor-related flaw (CWE-776). This can lead to a stack overflow that crashes the process, making the application unavailable to users. Attackers can trigger the crash remotely by sending crafted XML to any component that relies on Qt XML parsing, resulting in a denial-of-service condition.

Affected Systems

Qt libraries used in desktop and embedded applications. The vulnerability affects any product that includes the vulnerable Qt XML module; no specific version range is published, so all installations that have not applied the latest Qt base update are potentially exposed.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% shows a low probability of exploitation, meaning this vulnerability has not been widely exploited yet. This issue does not appear in the CISA KEV catalog. Attackers can target the vulnerable component from outside by supplying malicious XML. No special privileges or local access are required for exploitation.

Generated by OpenCVE AI on September 18, 2026 at 12:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Qt version that includes the patch for the QDomNode destructor issue.
  • If an upgrade is not immediately possible, sandbox the XML parsing or process untrusted input in a separate, low-privilege process to contain crashes.
  • Validate or sanitize XML input before passing it to Qt's XML parser, rejecting any documents that exceed reasonable depth or size limits.

Generated by OpenCVE AI on September 18, 2026 at 12:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-776
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 16 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Qt
Qt qt
Vendors & Products Qt
Qt qt

Wed, 16 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Title Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
Weaknesses CWE-674
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L'}

Subscriptions

Qt Qt
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published:

Updated: 2026-09-16T15:02:54.099Z

Reserved: 2026-08-07T12:46:51.889Z

Link: CVE-2026-19248

cve-icon Vulnrichment

Updated: 2026-09-16T15:02:50.368Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T07:16:32.943

Modified: 2026-09-18T19:21:34.307

Link: CVE-2026-19248

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-16T06:37:40Z

Links: CVE-2026-19248 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T12:15:06Z

Weaknesses
  • CWE-674

    Uncontrolled Recursion

  • CWE-776

    Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')