ALSA-2026:98103: Important: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/qt5-qtbase-commonto a version that resolves this vulnerability.Fixed in 5.15.3-11.el8_10
Event History
Frequently Asked Questions
What kind of impact can exploitation have?
The issue is described as a denial of service caused by crafted XML parsing in QXmlStreamReader. An attacker would need to cause the affected Qt component to parse maliciously crafted XML.
Which systems should be prioritized for remediation?
Prioritize AlmaLinux systems using the qt5-qtbase-common package where applications process XML with QXmlStreamReader, particularly when XML input can originate from untrusted sources.
How can I determine whether a system may be affected?
Check whether the system is running the AlmaLinux qt5-qtbase-common package and identify applications that use Qt's QXmlStreamReader to parse XML. The advisory data does not provide affected or fixed package version numbers.