---
id: "CVE-2026-8168"
kind: "vulnerability"
aliases: ["CVE-2026-8168"]
title: "Qt SVG: deeply nested SVG file crashes applications via stack exhaustion"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "desktop-apps", "package", "qt", "qtsvg"]
not_affected_if: ["no-svg-rendering", "trusted-input-only"]
published_at: "2026-10-19T14:17:08+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8168", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Qt SVG: deeply nested SVG file crashes applications via stack exhaustion

The Qt SVG module parses and renders SVG files with unbounded recursion on nested elements. A crafted SVG with deeply nested elements exhausts the stack and crashes the application, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed QtSvg version, for example with `qmake -query QT_VERSION` or the Qt version in your build manifest, and compare it with the fixed release in the sources.
- Search your code and build for uses of QtSvg (`QSvgRenderer`, `QSvgWidget`, `QtSvg` in CMake or qmake files) to see whether the application renders SVG from untrusted input.

## Fix

- Upgrade Qt to a QtSvg release that fixes CVE-2026-8168; the fixed version is unknown from the sources.
- Until patched, reject or size-limit SVG uploads from untrusted sources before passing them to QtSvg.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8168

## From the sources

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_