---
id: "CVE-2026-97845"
page: "https://infrastack.ai/live/CVE-2026-97845"
kind: "vulnerability"
aliases: ["CVE-2026-97845"]
title: "Qt: uncontrolled recursion in XML parser can crash applications"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "package", "qt"]
not_affected_if: ["no-untrusted-xml"]
published_at: "2026-11-12T14:17:30+00:00"
first_seen_at: "2026-11-12T14:38:37+00:00"
updated_at: "2026-11-12T14:39:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97845", "first_seen_at": "2026-11-12T14:38:37+00:00"}]
exploit_sources: []
---

# Qt: uncontrolled recursion in XML parser can crash applications

Link for people: https://infrastack.ai/live/CVE-2026-97845 (this .md is for agents)

Qt's QXmlSimpleReader, the XML parsing code in the Qt 5 Core Compatibility APIs and the Qt XML module, can recurse without limit on crafted input. An attacker who can feed the application an XML document can likely exhaust the stack and crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your application links against the Qt XML module (Qt 5) or the Qt 5 Core Compatibility APIs (Qt 6) and uses QXmlSimpleReader to parse untrusted XML.
- Check your Qt version with `qmake --version` or the version your build pins; the sources do not list affected versions.

## Timeline

- 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97845

## From the sources

An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_