CVE-2026-11573: QDomDocument::toByteArray() crashes when parsing svg file
Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).
Affected Software
Event History
Frequently Asked Questions
What applications are exposed to this issue?
Applications that use QtXml's QDomDocument to parse and serialize untrusted XML are exposed if an attacker can supply deeply nested XML. The reported impact is an application crash through stack exhaustion.
What must an attacker provide to trigger the crash?
The attacker needs to cause the application to process deeply nested untrusted XML and serialize the resulting QDomDocument with toByteArray(). The issue is denial of service only.
How can I determine whether an application may be affected?
Review whether the application accepts XML from untrusted sources, uses QDomDocument from QtXml to parse it, and calls QDomDocument::toByteArray() on the parsed document. Deeply nested XML in that processing path is the relevant condition.