An attacker can deliver a carefully crafted SVG file that contains extremely nested elements, triggering uncontrolled recursion in the Qt Svg module’s parser and renderer. The recursion exhausts the process stack, causing the application to crash. The vulnerability results in an availability loss for any process that loads and renders such an SVG, without compromising confidentiality or integrity.

The Qt framework, specifically the QtSvg module, is affected. All Qt installations that include this module are at risk when they parse or render untrusted SVG content. Versions are not explicitly listed in the advisory, so any deployment using QtSvg should be considered potentially vulnerable until the patch is applied.

The CVSS score of 7.1 indicates moderate severity. EPSS is not available, so the public exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs to supply a malicious SVG file that is processed by the application; no network access or privilege escalation is required. The risk is primarily for availability of the target application, with potential impact on users if the application is critical for services.