OESA-2026-4612: qt6-qtbase security update
Qt is a software toolkit for developing applications. Security Fix(es):
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.(CVE-2026-11573)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qt6-qtbaseto a version that resolves this vulnerability.Fixed in 6.5.2-16.oe2403sp1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using QtXml's QDomDocument or QDomNode serialization paths are exposed if they can parse a deeply nested XML document and subsequently serialize that DOM. Relevant interfaces include QDomDocument::toByteArray(), toString(), toCString(), QDomNode::save(), and QTextStream output for QDomNode.
What does exploitation require?
Exploitation requires a deeply nested XML document that parses successfully and is later serialized through an affected API. The supplied vector indicates user interaction is required.
What is the practical impact of a successful attack?
Serialization consumes a stack frame for each nesting level until the process exhausts its call stack and terminates. The stated impact is denial of service only; no code execution or memory disclosure is described.