Live › vulnerability › CVE-2026-16762
Go to dashboardA crafted XML document makes QXmlStreamReader (Qt Core, qtbase) burn excessive CPU while parsing, so the application stops responding (CWE-407). It needs no authentication or user interaction, only that the app parses attacker-influenced XML. There is no data disclosure or code execution, and the impact stays in the process. Qt rates it CVSS 4.0 8.7. QtXml and QDomDocument are not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| qtbase | vendor | >= 4.3.0, <= 6.8.8; >= 6.9.0, <= 6.11.1 | 6.8.9, 6.11.2, 6.12.0 |
4.3.0 to 6.8.8 or 6.9.0 to 6.11.1, AND the app feeds untrusted XML to QXmlStreamReader (grep the source for QXmlStreamReader)6.8.9, 6.11.2 or 6.12.0 or later, or apply the Qt patches (6.11 and 6.8 .diff files linked in the advisory)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
This page as .md · .json · in your agent: get_signal("CVE-2026-16762")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.