Live › vulnerability › CVE-2026-8168
Go to dashboardThe Qt SVG module parses and renders SVG files with unbounded recursion on nested elements. A crafted SVG with deeply nested elements exhausts the stack and crashes the application, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that link QtSvg and render SVG files supplied by users, other systems or the internet, such as image upload, preview or document tools. Applications that only render SVG bundled with the program or that never load SVG can skip it. The sources do not give the affected version range.
No product ranges from the sources yet.
qmake -query QT_VERSION or the Qt version in your build manifest, and compare it with the fixed release in the sources.QSvgRenderer, QSvgWidget, QtSvg in CMake or qmake files) to see whether the application renders SVG from untrusted input.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
This page as .md · .json · in your agent: get_signal("CVE-2026-8168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.