[Development] [Announce] Security advisory: CVE-2026-8168

[List for announcements regarding Qt releases and development via Announce]

A denial-of-service vulnerability in the parser and renderer of the Qt SVG module (QtSvg) has been discovered and has been assigned the CVE id CVE-2026-8168.
Affected versions: from Qt 4.1.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1
Affected status unknown before 4.1.0
Impact: When a Qt application loads an SVG file containing excessively deep element nesting, the Qt SVG module traverses the document tree recursively — while resolving paint servers, detecting cycles, rendering, and destroying the internal tree — without enforcing any recursion depth limit. This exhausts the process call stack and crashes the application (denial of service).
CVSS 4.0 Score: 7.1 (HIGH)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Mitigation: Only load SVG content from trusted sources. Validate and sanitize SVG content before loading, or restrict which SVG files users are able to load.
Solution: Apply all of the patches listed for your branch, or update to Qt 6.8.9, Qt 6.11.2 or Qt 6.12.0 or later.
Patches:
dev:
https://codereview.qt-project.org/c/qt/qtsvg/+/730591 — Fix rendering causing stack overflow
https://codereview.qt-project.org/c/qt/qtsvg/+/730501 — Fix resolving paint servers going through stack overflow
https://codereview.qt-project.org/c/qt/qtsvg/+/731257 — Fix stack overflow caused by recursive calls of destructors
https://codereview.qt-project.org/c/qt/qtsvg/+/730892 — Add a test for deeply nested SVG files
https://codereview.qt-project.org/c/qt/qtsvg/+/733245 — Add baseline test for deeply nested elements
https://codereview.qt-project.org/c/qt/qtsvg/+/738811 — Speed up QSvgStructureNode::releaseDescendants()
https://codereview.qt-project.org/c/qt/qtsvg/+/730590 — Fix stack overflow in detectCycles
https://codereview.qt-project.org/c/qt/qtsvg/+/743488 — Use bottom tested loop in detectCycles()
https://codereview.qt-project.org/c/qt/qtsvg/+/748966 — Apply and revert styles iteratively
https://codereview.qt-project.org/c/qt/qtsvg/+/756512 — Propagate QSvgExtraStates variables to pattern and mask elements
Qt 6.11:
https://codereview.qt-project.org/c/qt/qtsvg/+/731258 — Fix rendering causing stack overflow
https://codereview.qt-project.org/c/qt/qtsvg/+/731666 — Fix resolving paint servers going through stack overflow
https://codereview.qt-project.org/c/qt/qtsvg/+/735617 — Fix stack overflow caused by recursive calls of destructors
https://codereview.qt-project.org/c/qt/qtsvg/+/738735 — Add a test for deeply nested SVG files
https://codereview.qt-project.org/c/qt/qtsvg/+/739054 — Add baseline test for deeply nested elements
https://codereview.qt-project.org/c/qt/qtsvg/+/739119 — Speed up QSvgStructureNode::releaseDescendants()
https://codereview.qt-project.org/c/qt/qtsvg/+/743558 — Fix stack overflow in detectCycles
https://codereview.qt-project.org/c/qt/qtsvg/+/743573 — Use bottom tested loop in detectCycles()
https://codereview.qt-project.org/c/qt/qtsvg/+/749237 — Apply and revert styles iteratively
https://codereview.qt-project.org/c/qt/qtsvg/+/761767 — Propagate QSvgExtraStates variables to pattern and mask elements
or
https://download.qt.io/official_releases/qt/6.11/CVE-2026-8168-qtsvg-6.11.zip
Qt 6.8:
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/737527 — Fix rendering causing stack overflow
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/737586 — Fix stack overflow caused by recursive calls of destructors
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/738495 — Fix resolving paint servers going through stack overflow
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/738778 — Add a test for deeply nested SVG files
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/739083 — Add baseline test for deeply nested elements
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/739129 — Speed up QSvgStructureNode::releaseDescendants()
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/743580 — Fix stack overflow in detectCycles
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/743617 — Use bottom tested loop in detectCycles()
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/749260 — Apply and revert styles iteratively
https://codereview.qt-project.org/c/qt/tqtc-qtsvg/+/761779 — Propagate QSvgExtraStates variables to pattern and mask elements
or
https://download.qt.io/archive/qt/6.8/CVE-2026-8168-qtsvg-6.8.zip


Tero Pelkonen
Qt Group

Confidential
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/development/attachments/20261019/569e8409/attachment.htm>
-------------- next part --------------
_______________________________________________
Announce mailing list
Announce at qt-project.org
https://lists.qt-project.org/listinfo/announce