Vulnerability in qt

[ Description ]Official description

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4037

  QT: Vulnerability allows denial of service Translated from German

  CVE-2026-8168

[ References ]References

• codereview.qt-project.org/c/qt/qtsvg/+/730501
• codereview.qt-project.org/c/qt/qtsvg/+/730590
• codereview.qt-project.org/c/qt/qtsvg/+/730591
• codereview.qt-project.org/c/qt/qtsvg/+/730892
• codereview.qt-project.org/c/qt/qtsvg/+/731257
• codereview.qt-project.org/c/qt/qtsvg/+/733245
• codereview.qt-project.org/c/qt/qtsvg/+/738811
• codereview.qt-project.org/c/qt/qtsvg/+/743488
• codereview.qt-project.org/c/qt/qtsvg/+/748966
• codereview.qt-project.org/c/qt/qtsvg/+/756512
• wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products