The vulnerability arises from uncontrolled recursion inside QXmlStreamReader::readElementText in Qt. Malicious XML can cause stack exhaustion, resulting in an application crash and a denial‑of‑service. This flaw is classified as CWE‑674 and does not provide any mechanism for arbitrary code execution, but it can disable services or applications that rely on Qt's XML parser.

The issue affects Qt applications that use the QXmlStreamReader::readElementText API. No specific Qt version is listed as affected, so all releases that include this code path are potentially impacted. The vulnerability is present in the Qt library itself.

The CVSS score is 2.3, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, which implies a low likelihood of exploitation. The attack vector is likely an attacker delivering a crafted XML document to an application using the vulnerable parser; it requires the application to parse such input. The impact is limited to an untrusted application crash, which could disrupt services but does not compromise data or provide further access.