CVE-2026-19248: Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
Published Sep 16, 2026
·Updated
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Affected Software
1 affected component
Qt Qt XML
Event History
Sep 16, 2026
CVE Published
via MITRE·06:37 AM
Data Sourced
via MITRE·06:37 AM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this denial-of-service issue?
Applications using Qt XML's QDomDocument to parse untrusted XML input are exposed to a remotely triggered crash.
2
What must an attacker provide to trigger the issue?
An attacker needs to cause the application to process malicious untrusted XML through QDomDocument parsing.