Description
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Published: 2026-09-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A parsing bug in Qt's QDomNode destructor causes unbounded recursion when handling malformed XML. The bug can lead to a stack overflow that crashes the process, making the application unavailable to users. Attackers can trigger the crash remotely by sending crafted XML to any component reliant on Qt XML parsing.

Affected Systems

Qt libraries used in desktop and embedded applications. The vulnerability affects any product that includes the vulnerable Qt XML module; no specific version range is published, so all installations that have not applied the latest Qt base update are potentially exposed.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity risk. EPSS is not available, suggests this issue has not been widely exploited yet. However, attackers can target the vulnerable component from outside by supplying malicious XML No special privileges or local access are required for exploitation.

Generated by OpenCVE AI on September 16, 2026 at 13:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Qt version that includes the patch for the QDomNode destructor issue.
  • If an upgrade is not immediately possible, sandbox the XML parsing or process untrusted input in a separate, low-privilege process to contain crashes.
  • Validate or sanitize XML input before passing it to Qt's XML parser, rejecting any documents that exceed reasonable depth or size limits.

Generated by OpenCVE AI on September 16, 2026 at 13:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-776
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 16 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Qt
Qt qt
Vendors & Products Qt
Qt qt

Wed, 16 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Title Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
Weaknesses CWE-674
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L'}

Subscriptions

Qt Qt
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published:

Updated: 2026-09-16T15:02:54.099Z

Reserved: 2026-08-07T12:46:51.889Z

Link: CVE-2026-19248

cve-icon Vulnrichment

Updated: 2026-09-16T15:02:50.368Z

cve-icon NVD

Status : Received

Published: 2026-09-16T07:16:32.943

Modified: 2026-09-16T16:17:06.487

Link: CVE-2026-19248

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-16T06:37:40Z

Links: CVE-2026-19248 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T13:30:10Z

Weaknesses
  • CWE-674

    Uncontrolled Recursion

  • CWE-776

    Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')