---
id: "CVE-2026-16762"
kind: "vulnerability"
aliases: ["CVE-2026-16762"]
title: "Qt QXmlStreamReader: crafted XML causes CPU exhaustion and denial of service"
severity: "high"
cvss: 8.7
epss: 0.00426
exploited: false
status: "open"
category: "runtime"
products: [{"name": "qtbase", "fixed": ["6.8.9", "6.11.2", "6.12.0"], "affected": ">= 4.3.0, <= 6.8.8; >= 6.9.0, <= 6.11.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["c++", "denial-of-service", "qt", "qxmlstreamreader", "runtime", "xml-parsing"]
not_affected_if: ["no-untrusted-xml", "no-untrusted-xml-input", "qt-6.11.2-or-later", "qt-6.8.9-or-later", "qtxml-only"]
published_at: "2026-10-23T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16762", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:36:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-16762", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Qt QXmlStreamReader: crafted XML causes CPU exhaustion and denial of service

A crafted XML document makes QXmlStreamReader (Qt Core, qtbase) burn excessive CPU while parsing, so the application stops responding (CWE-407). It needs no authentication or user interaction, only that the app parses attacker-influenced XML. There is no data disclosure or code execution, and the impact stays in the process. Qt rates it CVSS 4.0 8.7. QtXml and QDomDocument are not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:qtbase affected >= 4.3.0, <= 6.8.8; >= 6.9.0, <= 6.11.1 fixed 6.8.9, 6.11.2, 6.12.0

## How to check

Find the Qt version your app is built or linked against (qmake -query QT_VERSION, or the Qt version in your CMake/package). Affected if it is 4.3.0 to 6.8.8 or 6.9.0 to 6.11.1, AND the app feeds untrusted XML to QXmlStreamReader (grep the source for QXmlStreamReader).

## Fix

Update Qt to 6.8.9, 6.11.2 or 6.12.0 or later, or apply the Qt patches (6.11 and 6.8 .diff files linked in the advisory). Until then, cap input size and attribute count on untrusted XML and enforce a parse timeout.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16762
- 2026-10-23T23:36:28+00:00 analyst — Read Qt's own advisory and wiki: affected 4.3.0 to 6.8.8 and 6.9.0 to 6.11.1, fixed in 6.8.9, 6.11.2 and 6.12.0. No exploitation or public PoC found; I did not search social posts, since this is a routine DoS.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-16762

## Documents

- [advisory] Qt security advisory CVE-2026-16762 https://www.qt.io/blog/cve-2026-16762
- [fix] Qt wiki: known vulnerabilities https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products

## From the sources

An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_