CVE-2026-8168

EUVD-2026-104329
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
QtCNA
7.1 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.51%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
qtqt
4.1.0 ≤
𝑥
< 6.8.9
CNA
qtqt
6.9.0 ≤
𝑥
< 6.11.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
qt6-svg
bookworm
vulnerable
forky
6.11.2-2
fixed
sid
6.11.2-2
fixed
trixie
vulnerable
qtsvg-opensource-src
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://codereview.qt-project.org/c/qt/qtsvg/+/730501
https://codereview.qt-project.org/c/qt/qtsvg/+/730590
https://codereview.qt-project.org/c/qt/qtsvg/+/730591
https://codereview.qt-project.org/c/qt/qtsvg/+/730892
https://codereview.qt-project.org/c/qt/qtsvg/+/731257
https://codereview.qt-project.org/c/qt/qtsvg/+/733245
https://codereview.qt-project.org/c/qt/qtsvg/+/738811
https://codereview.qt-project.org/c/qt/qtsvg/+/743488
https://codereview.qt-project.org/c/qt/qtsvg/+/748966
https://codereview.qt-project.org/c/qt/qtsvg/+/756512
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168: