{"id":"CVE-2026-8168","kind":"vulnerability","aliases":["CVE-2026-8168"],"related":[],"title":"Qt SVG: deeply nested SVG file crashes applications via stack exhaustion","description":"Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.","summary":"The Qt SVG module parses and renders SVG files with unbounded recursion on nested elements. A crafted SVG with deeply nested elements exhausts the stack and crashes the application, a denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","desktop-apps","package","qt","qtsvg"],"not_affected_if":["no-svg-rendering","trusted-input-only"],"how_to_check":"- Check the installed QtSvg version, for example with `qmake -query QT_VERSION` or the Qt version in your build manifest, and compare it with the fixed release in the sources.\n- Search your code and build for uses of QtSvg (`QSvgRenderer`, `QSvgWidget`, `QtSvg` in CMake or qmake files) to see whether the application renders SVG from untrusted input.","fix":"- Upgrade Qt to a QtSvg release that fixes CVE-2026-8168; the fixed version is unknown from the sources.\n- Until patched, reject or size-limit SVG uploads from untrusted sources before passing them to QtSvg.","status":"open","published_at":"2026-10-19T14:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:34:55+00:00","updated_at":"2026-10-25T03:34:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Qt to a QtSvg release that fixes CVE-2026-8168; the fixed version is unknown from the sources.\n- Until patched, reject or size-limit SVG uploads from untrusted sources before passing them to QtSvg.","reach":"unknown","title":"Qt SVG: deeply nested SVG file crashes applications via stack exhaustion","impact":"low","summary":"The Qt SVG module parses and renders SVG files with unbounded recursion on nested elements. A crafted SVG with deeply nested elements exhausts the stack and crashes the application, a denial of service.","category":"package","nicknames":[],"who_cares":["qt","qtsvg","desktop-apps","c++"],"confidence":0.6,"needs_auth":"unknown","worst_case":"application crashes from stack exhaustion when rendering a crafted SVG","analyst_note":"Find the affected and fixed QtSvg versions and the advisory from the Qt Group, since the NVD entry gives neither.","how_to_check":"- Check the installed QtSvg version, for example with `qmake -query QT_VERSION` or the Qt version in your build manifest, and compare it with the fixed release in the sources.\n- Search your code and build for uses of QtSvg (`QSvgRenderer`, `QSvgWidget`, `QtSvg` in CMake or qmake files) to see whether the application renders SVG from untrusted input.","needs_analyst":true,"not_affected_if":["no-svg-rendering","trusted-input-only"],"who_is_affected":"Applications that link QtSvg and render SVG files supplied by users, other systems or the internet, such as image upload, preview or document tools. Applications that only render SVG bundled with the program or that never load SVG can skip it. The sources do not give the affected version range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3321,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-8168':14A,17A 'allow':76C 'app':21B 'applic':8A,53B,84C 'attack':77C 'c':18B 'caus':79C 'craft':41B,91C 'crash':7A,51B,85C 'cve':12A,15A 'deepli':3A,44B,95C 'denial':55B,81C 'desktop':20B 'desktop-app':19B 'element':39B,46B,97C 'exhaust':11A,47B,88C 'file':6A,33B,93C 'group':74C 'modul':28B,70C 'nest':4A,38B,45B,96C 'packag':22B 'pars':29B 'parser':63C 'qt':1A,23B,26B,68C,73C,75C 'qtsvg':24B,71C 'recurs':36B,59C 'render':31B,65C 'servic':57B,83C 'stack':10A,49B,87C 'svg':2A,5A,27B,32B,42B,62C,69C,92C 'unbound':35B 'uncontrol':58C 'via':9A,86C,89C","nicknames":[],"mitigations":[],"who_affected":"Applications that link QtSvg and render SVG files supplied by users, other systems or the internet, such as image upload, preview or document tools. Applications that only render SVG bundled with the program or that never load SVG can skip it. The sources do not give the affected version range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8168","severity":null,"published_at":"2026-10-19T14:17:08+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}