CVE-2026-78253: Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
Other sources
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.3-7
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs to supply a crafted XML document that is processed by QXmlStreamReader::readElementText(). The result is an application crash caused by stack exhaustion.
Which deployments are exposed?
Applications using Qt's QXmlStreamReader::readElementText() to parse attacker-controlled or otherwise untrusted XML are exposed. The provided information does not identify affected versions or configuration-specific conditions.
What can be done if an update cannot be applied immediately?
Avoid passing untrusted XML to QXmlStreamReader::readElementText(), or validate and constrain XML input before it reaches that method. The provided information does not specify an official workaround.