Skip to main content

Security advisory: CVE-2026-19248: Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

Sep 11, 2026

by Tero Pelkonen
Comments

Unbounded destructor recursion in the QDomNode destructor of Qt XML has been discovered and has been assigned the CVE id CVE-2026-19248. 

Affected versions: from Qt 2.2.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1 
 
Impact:  Applications that parse untrusted or externally-supplied XML using the QDom classes (e.g. QDomDocument) may crash due to a denial-of-service condition. This may potentially be triggered remotely if the XML originates from an untrusted network source. 
 
CVSS 4.0 Score: 7.1 (High)
 
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L 
 
Mitigation:
- Use QXmlStreamReader / QXmlStreamWriter instead of QDomDocument.
- Limit the depth of the XML being parsed through other means.
- Increase the stack size from the default.
- Build Qt in a mode that uses less stack per frame than the default compiler settings. 
 
Solution:  Update to Qt 6.8.9, Qt 6.11.2, or later. Users remaining on the now-closed Qt 6.10 branch should apply the Qt 6.10 patch.
 

 

 

Blog Topics

Comments

Comments are disabled for this post.

Subscribe to our blog

Try Qt 6.11 Now!

Download the latest release here: www.qt.io/download

Qt 6.11 is now available, with new features and improvements for application developers and device creators.

We're Hiring

Check out all our open positions here and follow us on Instagram to see what it's like to be #QtPeople.

Related Articles

Security advisory: CVE-2026-76151 out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

Security advisory: CVE-2026-76151 out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

An out-of-bounds read (buffer over-read) vulnerability in the HTTP..

Read Article
Security advisory: CVE-2026-13326 Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module

Security advisory: CVE-2026-13326 Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module

An out-of-bounds read and integer underflow vulnerability in the..

Read Article