CVE-2026-78253: Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs to supply a crafted XML document that is processed by QXmlStreamReader::readElementText(). The result is an application crash caused by stack exhaustion.
Which deployments are exposed?
Applications using Qt's QXmlStreamReader::readElementText() to parse attacker-controlled or otherwise untrusted XML are exposed. The provided information does not identify affected versions or configuration-specific conditions.
What can be done if an update cannot be applied immediately?
Avoid passing untrusted XML to QXmlStreamReader::readElementText(), or validate and constrain XML input before it reaches that method. The provided information does not specify an official workaround.