OESA-2026-4795: qt security update

Q: What kind of impact can exploitation have?

The issue can crash an application through stack exhaustion, resulting in a denial of service. The available data describes it as DoS-only and does not indicate confidentiality or integrity impact.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide deeply nested, untrusted XML that is processed during QDomDocument serialization in QtXml. The supplied severity vector indicates network attack access, low attack complexity, no required privileges, and user interaction.

Q: Which applications are most relevant to triage?

Applications using QtXml QDomDocument serialization and accepting XML from untrusted sources are the relevant exposure points. The affected software listing identifies openEuler Qt.

Published Nov 11, 2026

Updated

Qt (pronounced as &quot;cute&quot;, not &quot;cu-tee&quot;) is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo or BB10, and on embedded devices. Ports for Android (Necessitas) and iOS are also in development Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Affected Software

1 affected componentFixes available

openeuler/qt<4.8.7-68.oe2403sp3

4.8.7-68.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/qt to a version that resolves this vulnerability.
Fixed in 4.8.7-68.oe2403sp3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-11573

Frequently Asked Questions

What kind of impact can exploitation have?

The issue can crash an application through stack exhaustion, resulting in a denial of service. The available data describes it as DoS-only and does not indicate confidentiality or integrity impact.

What does an attacker need to exploit this issue?

An attacker needs to provide deeply nested, untrusted XML that is processed during QDomDocument serialization in QtXml. The supplied severity vector indicates network attack access, low attack complexity, no required privileges, and user interaction.

Which applications are most relevant to triage?

Applications using QtXml QDomDocument serialization and accepting XML from untrusted sources are the relevant exposure points. The affected software listing identifies openEuler Qt.

OESA-2026-4795: qt security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What kind of impact can exploitation have?

What does an attacker need to exploit this issue?

Which applications are most relevant to triage?

Company

Resources

Contact

Frequently Asked Questions

What kind of impact can exploitation have?

What does an attacker need to exploit this issue?

Which applications are most relevant to triage?