CVE-2026-8168: Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Published Oct 19, 2026
·Updated
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Affected Software
12 affected components
Qt Group QtSvg
ubuntu/qtsvg-opensource-src*
ubuntu/qtsvg-opensource-src*
ubuntu/qtsvg-opensource-src*
ubuntu/qt6-svg*
ubuntu/qtsvg-opensource-src*
ubuntu/qt6-svg*
ubuntu/qtsvg-opensource-src*
ubuntu/qt6-svg*
ubuntu/qtsvg-opensource-src*
ubuntu/qt6-svg*
ubuntu/qtsvg-opensource-src*
Event History
Oct 19, 2026
CVE Published
via MITRE·01:08 PM
Data Sourced
via MITRE·01:08 PM
DescriptionWeakness
Data Sourced
via OSV·02:17 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Applications that use the Qt SVG module (QtSvg) to parse or render SVG files are exposed when they process attacker-controlled SVG content.
2
What does an attacker need to exploit it?
An attacker needs to induce the application to process a crafted SVG file containing deeply nested elements. The CVSS vector indicates no privileges are required, but user interaction is required.
3
What is the expected impact of successful exploitation?
Successful exploitation can exhaust the application stack through uncontrolled recursion and crash the application, causing a denial of service.