High
Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Announced Source revision 1
Original source ↗CVE-2026-8168
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-8168
qt
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
"cpe:2.3:a:qt:qtsvg:*:*:*:*:*:*:*:*"
],
"vendor": "qt",
"modules": [
"qtsvg"
],
"product": "qt",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"lessThan": "6.8.9",
"versionType": "python"
},
{
"status": "affected",
"version": "6.9.0",
"lessThan": "6.11.2",
"versionType": "python"
},
{
"status": "unknown",
"version": "0",
"lessThan": "4.1.0",
"versionType": "python"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-8168
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #38890 · Revision 1
- Added to Heist Feed
- Publisher date