{"id":"CVE-2026-97845","kind":"vulnerability","aliases":["CVE-2026-97845"],"related":[],"title":"Qt: uncontrolled recursion in XML parser can crash applications","description":"An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).","summary":"Qt's QXmlSimpleReader, the XML parsing code in the Qt 5 Core Compatibility APIs and the Qt XML module, can recurse without limit on crafted input. An attacker who can feed the application an XML document can likely exhaust the stack and crash the process.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","qt"],"not_affected_if":["no-untrusted-xml"],"how_to_check":"- Check whether your application links against the Qt XML module (Qt 5) or the Qt 5 Core Compatibility APIs (Qt 6) and uses QXmlSimpleReader to parse untrusted XML.\n- Check your Qt version with `qmake --version` or the version your build pins; the sources do not list affected versions.","fix":null,"status":"open","published_at":"2026-11-12T14:17:30+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:12+00:00","updated_at":"2026-11-12T14:39:12+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-12T14:39:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Qt: uncontrolled recursion in XML parser can crash applications","impact":"low","summary":"Qt's QXmlSimpleReader, the XML parsing code in the Qt 5 Core Compatibility APIs and the Qt XML module, can recurse without limit on crafted input. An attacker who can feed the application an XML document can likely exhaust the stack and crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["qt","c++"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Crafted XML makes the parser recurse until the application crashes","analyst_note":"Find the affected and fixed Qt versions and the advisory from the Qt project; the NVD entry gives only the description and CVSS 4.3.","how_to_check":"- Check whether your application links against the Qt XML module (Qt 5) or the Qt 5 Core Compatibility APIs (Qt 6) and uses QXmlSimpleReader to parse untrusted XML.\n- Check your Qt version with `qmake --version` or the version your build pins; the sources do not list affected versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xml"],"who_is_affected":"Applications built on Qt that parse XML from untrusted sources with QXmlSimpleReader. The sources do not give affected version ranges or a fixed version, and do not say whether the impact goes beyond a crash.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4545,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-97845':12A,15A '5':29B,81C,94C '6':87C 'api':32B,84C 'applic':9A,51B 'attack':46B 'c':16B 'code':25B 'compat':31B,83C 'core':30B,82C 'craft':43B 'crash':8A,61B 'cve':10A,13A 'discov':70C 'document':54B 'exhaust':57B 'feed':49B 'function':77C 'input':44B 'like':56B 'limit':41B 'modul':37B,85C,92C 'packag':17B 'pars':24B,76C 'parser':6A 'process':63B 'qt':1A,18B,19B,28B,35B,73C,80C,86C,90C,93C 'qxmlsimpleread':21B,74C 'recurs':3A,39B,66C 'stack':59B 'uncontrol':2A,65C 'vulner':67C 'without':40B 'xml':5A,23B,36B,53B,75C,91C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Qt that parse XML from untrusted sources with QXmlSimpleReader. The sources do not give affected version ranges or a fixed version, and do not say whether the impact goes beyond a crash.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","medium","package","qt"],"campaign_type":null,"search_a":"'-2026':11A,14A '-97845':12A,15A 'applic':9A 'crash':8A 'cve':10A,13A 'parser':6A 'qt':1A 'recurs':3A 'uncontrol':2A 'xml':5A","search_b":"'5':29B 'api':32B 'applic':51B 'attack':46B 'c':16B 'code':25B 'compat':31B 'core':30B 'craft':43B 'crash':61B 'document':54B 'exhaust':57B 'feed':49B 'input':44B 'like':56B 'limit':41B 'modul':37B 'packag':17B 'pars':24B 'process':63B 'qt':18B,19B,28B,35B 'qxmlsimpleread':21B 'recurs':39B 'stack':59B 'without':40B 'xml':23B,36B,53B","search_c":"'5':81C,94C '6':87C 'api':84C 'compat':83C 'core':82C 'discov':70C 'function':77C 'modul':85C,92C 'pars':76C 'qt':73C,80C,86C,90C,93C 'qxmlsimpleread':74C 'recurs':66C 'uncontrol':65C 'vulner':67C 'xml':75C,91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97845","severity":null,"published_at":"2026-11-12T14:17:30+00:00","modified_at":"2026-11-12T14:17:30+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}