[Development] [Announce] Security advisory: CVE-2026-11573 QDomDocument::toByteArray() crashes when parsing svg file

[List for announcements regarding Qt releases and development via Announce]

An uncontrolled recursion (CWE-674) vulnerability in the Qt QDomDocument serialization path (QDomDocument::toByteArray(), QDomNode::save()) of the Qt XML module (QtXml, qtbase) has been discovered and has been assigned the CVE id CVE-2026-11573.
[cid:ec35892d-9f82-4887-80bb-d36a1f0e1976]
Affected versions: from 6.7.0 to 6.8.1

Impact: Denial of service only. QDomDocument serializes its node tree recursively, consuming one stack frame per level of element nesting with no depth limit. A crafted document with deeply nested elements — for example an SVG or XML file from an untrusted source — exhausts the call stack and terminates the process when the document is serialized. On Windows/MSVC roughly 300 levels of nesting is sufficient; other toolchains tolerate more nesting but remain affected. Note that parsing succeeds and the crash occurs only on serialization, so the application must re-serialize a QDomDocument it built from untrusted input (load, then toByteArray()/save()).

This issue is limited to availability. It does not result in memory disclosure, data corruption, or privilege escalation, and has no impact on confidentiality or integrity. The sole impact is that a maliciously crafted XML payload can cause the application to crash by exhausting the C++ call stack through unbounded recursive serialization.

CVSS 4.0 Score: 7.1 (High)

Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Mitigation: For users who cannot update immediately, validate the nesting depth of untrusted XML/SVG content before loading and serializing it, and reject documents exceeding a sane depth bound. Avoid round-tripping (parse-then-serialize) untrusted documents. Where a full DOM round-trip is not required, QXmlStreamReader/QXmlStreamWriter avoid building and recursively serializing a tree altogether. Running serialization on a thread with a larger stack only raises the trigger threshold and is not a fix, since an attacker controlling nesting depth can exceed any fixed stack size.

Solution: Update to Qt 6.8.2 or Qt 6.9.0 or later, which serialize iteratively.

Patches:
dev: https://codereview.qt-project.org/c/qt/qtbase/+/606899<https://codereview.qt-project.org/c/qt/qtbase/+/606899?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_A_INIBSNWDTS-1o5w1FTzAHiNSr4qdIZin-dxq7TQPM74IxD0Cl1t-L1wCyECQbWZse_s>
Qt 6.8: https://codereview.qt-project.org/c/qt/qtbase/+/609607<https://codereview.qt-project.org/c/qt/qtbase/+/609607?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_A_INIBSNWDTS-1o5w1FTzAHiNSr4qdIZin-dxq7TQPM74IxD0Cl1t-L1wCyECQbWZse_s> or https://download.qt.io/official_releases/qt/6.8/CVE-2026-11573-qtbase-6.8.diff



Tero Pelkonen

Qt Group



Confidential
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.qt-project.org/pipermail/development/attachments/20260910/6b263d48/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 89 bytes
Desc: image.png
URL: <http://lists.qt-project.org/pipermail/development/attachments/20260910/6b263d48/attachment-0001.png>
-------------- next part --------------
_______________________________________________
Announce mailing list
Announce at qt-project.org
https://lists.qt-project.org/listinfo/announce