{"id":"CVE-2026-16762","kind":"vulnerability","aliases":["CVE-2026-16762"],"related":[],"title":"Qt QXmlStreamReader: crafted XML causes CPU exhaustion and denial of service","description":"An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.","summary":"A crafted XML document makes QXmlStreamReader (Qt Core, qtbase) burn excessive CPU while parsing, so the application stops responding (CWE-407). It needs no authentication or user interaction, only that the app parses attacker-influenced XML. There is no data disclosure or code execution, and the impact stays in the process. Qt rates it CVSS 4.0 8.7. QtXml and QDomDocument are not affected.","severity":"high","cvss":8.7,"epss":0.00426,"exploited":false,"exploited_at":null,"products":[{"name":"qtbase","fixed":["6.8.9","6.11.2","6.12.0"],"affected":">= 4.3.0, <= 6.8.8; >= 6.9.0, <= 6.11.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c++","denial-of-service","qt","qxmlstreamreader","runtime","xml-parsing"],"not_affected_if":["no-untrusted-xml","no-untrusted-xml-input","qt-6.11.2-or-later","qt-6.8.9-or-later","qtxml-only"],"how_to_check":"Find the Qt version your app is built or linked against (qmake -query QT_VERSION, or the Qt version in your CMake/package). Affected if it is 4.3.0 to 6.8.8 or 6.9.0 to 6.11.1, AND the app feeds untrusted XML to QXmlStreamReader (grep the source for QXmlStreamReader).","fix":"Update Qt to 6.8.9, 6.11.2 or 6.12.0 or later, or apply the Qt patches (6.11 and 6.8 .diff files linked in the advisory). Until then, cap input size and attribute count on untrusted XML and enforce a parse timeout.","status":"open","published_at":"2026-10-23T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:03+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T22:35:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Qt QXmlStreamReader: crafted XML causes CPU exhaustion and denial of service","impact":"low","summary":"A crafted XML document makes applications using Qt's QXmlStreamReader consume excessive CPU while parsing, so the process stops responding. The sources say there is no data disclosure, modification or code execution, and the impact stays inside the affected process.","category":"runtime","who_cares":["qt","c++","xml-parsing"],"confidence":0.6,"needs_auth":"no","worst_case":"Application becomes unresponsive from excessive CPU use during parsing","analyst_note":"Find affected Qt versions and the patched release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-16762) or the Qt advisory it links to.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-xml-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00048,"input_tokens":2961,"output_tokens":368,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Qt versions and the patched release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-16762) or the Qt advisory it links to.","search":"'-16762':14A,17A '-2026':13A,16A '-407':50B '4.0':86B '8.7':87B 'abl':96C 'affect':93B,168C 'app':61B 'applic':46B,105C,117C,127C 'attack':64B,95C,130C 'attacker-influenc':63B,129C 'authent':54B,134C 'beyond':139C 'burn':39B 'c':19B 'caus':5A,109C 'code':73B,159C 'confidenti':150C 'consumpt':112C 'contain':165C 'core':37B 'cpu':6A,41B,111C 'craft':3A,31B,100C 'cve':12A,15A 'cvss':85B 'cwe':49B 'data':70B,154C,156C 'denial':9A,21B,119C 'denial-of-servic':20B 'disclosur':71B,155C 'disproportion':110C 'document':33B,102C 'excess':40B 'execut':74B,160C 'exhaust':7A 'exploit':122C 'impact':77B,163C 'influenc':65B,131C 'ingest':140C 'input':142C 'integr':152C 'interact':57B,138C 'loss':148C 'make':34B,115C 'modif':157C 'need':52B,144C 'pars':29B,43B,62B,114C,128C 'privileg':135C 'process':81B,169C 'qdomdocu':90B 'qt':1A,24B,36B,82B 'qtbase':18A,38B 'qtxml':88B 'qxmlstreamread':2A,25B,35B,107C 'rate':83B 'requir':123C 'respond':48B 'runtim':26B 'servic':11A,23B,121C 'stay':78B 'stop':47B 'suppli':98C 'unrespons':118C 'use':106C 'user':56B,137C 'xml':4A,28B,32B,66B,101C,132C 'xml-pars':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16762","severity":null,"published_at":"2026-10-23T09:17:06+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16762:479","url":null,"severity":null,"published_at":"2026-10-23T23:36:28+00:00","modified_at":"2026-10-23T23:36:28+00:00","first_seen_at":"2026-10-23T23:36:28+00:00","fetched_at":"2026-10-23T23:36:28+00:00","note":"Read Qt's own advisory and wiki: affected 4.3.0 to 6.8.8 and 6.9.0 to 6.11.1, fixed in 6.8.9, 6.11.2 and 6.12.0. No exploitation or public PoC found; I did not search social posts, since this is a routine DoS."},{"source":"epss","external_id":"CVE-2026-16762","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-16762","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":2065,"url":"https://www.qt.io/blog/cve-2026-16762","title":"Qt security advisory CVE-2026-16762","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2066,"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products","title":"Qt wiki: known vulnerabilities","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}