A denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) of the qtbase component has been discovered and has been assigned the CVE id CVE-2026-16762.
Affected versions: from Qt 4.3.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1. QtXml / QDomDocument is not affected by this issue.
Affected status unknown before Qt 4.3.0.
Impact: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
CVSS 4.0 Score: 8.7 / HIGH
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Mitigation: Validate and size-limit untrusted XML before parsing (cap input size and attribute count at the ingress point) and enforce parse timeouts. Do not parse attacker-controlled XML in-process without such limits.
Solution: Apply the patches below, or update to Qt 6.8.9, Qt 6.11.2, Qt 6.12.0 or later.
Patches:
dev: https://codereview.qt-project.org/c/qt/qtbase/+/738885 and https://codereview.qt-project.org/c/qt/qtbase/+/738901
Qt 6.11: https://codereview.qt-project.org/c/qt/qtbase/+/746368 and https://codereview.qt-project.org/c/qt/qtbase/+/746369 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-16762-qtbase-6.11-0001.diff and https://download.qt.io/official_releases/qt/6.11/CVE-2026-16762-qtbase-6.11-0002.diff
Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/746715 and https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/746717 or https://download.qt.io/archive/qt/6.8/CVE-2026-16762-qtbase-6.8-0001.diff and https://download.qt.io/archive/qt/6.8/CVE-2026-16762-qtbase-6.8-0002.diff
