CVE-2026-8168: Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

Published Oct 19, 2026

Updated

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Affected Software

1 affected component

Qt Group QtSvg

Event History

Oct 19, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications that use the Qt SVG module (QtSvg) to parse or render SVG files are exposed when they process attacker-controlled SVG content.

What does an attacker need to exploit it?

An attacker needs to induce the application to process a crafted SVG file containing deeply nested elements. The CVSS vector indicates no privileges are required, but user interaction is required.

What is the expected impact of successful exploitation?

Successful exploitation can exhaust the application stack through uncontrolled recursion and crash the application, causing a denial of service.

CVE-2026-8168: Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact of successful exploitation?