All vulnerabilities
CVE-2026-8168

qt: Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

qt qt
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 33% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.8.9Also 6.11.2CVE List
Published19 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Text from CVE List

Affected versions 3

  • qtaffected: 4.1.0 before 6.8.9CVE List
  • qtaffected: 6.9.0 before 6.11.2CVE List
  • qtunknown: all versions before 4.1.0CVE List

References 11