QtSvg Uncontrolled Recursion in SVG Parser Causing DoS
CVE-2026-8168 Published on October 19, 2026
Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Vulnerability Analysis
CVE-2026-8168 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-8168 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-8168
stack.watch emails you whenever new vulnerabilities are published in Qt or Qtsvg. Just hit a watch button to start following.
Affected Versions
qt:- Version 4.1.0 and below 6.8.9 is affected.
- Version 6.9.0 and below 6.11.2 is affected.
- Before 4.1.0 is unknown.