CVE-2026-78253: Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt
Other sources
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qt6-baseto a version that resolves this vulnerability.Fixed in 6.11.2+dfsg-5 - Upgrade
Upgrade
debian/qtbase-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.19+dfsg-6 - Upgrade
Upgrade
debian/qt6-baseto a version that resolves this vulnerability.Fixed in 6.11.2+dfsg-7 - Upgrade
Upgrade
azurelinux/qtbaseto a version that resolves this vulnerability.Fixed in 6.6.3-7
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs to supply a crafted XML document that is processed by QXmlStreamReader::readElementText(). The result is an application crash caused by stack exhaustion.
Which deployments are exposed?
Applications using Qt's QXmlStreamReader::readElementText() to parse attacker-controlled or otherwise untrusted XML are exposed. The provided information does not identify affected versions or configuration-specific conditions.
What can be done if an update cannot be applied immediately?
Avoid passing untrusted XML to QXmlStreamReader::readElementText(), or validate and constrain XML input before it reaches that method. The provided information does not specify an official workaround.