OESA-2026-4797: qt security update
Qt (pronounced as "cute", not "cu-tee") is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo or BB10, and on embedded devices. Ports for Android (Necessitas) and iOS are also in development Security Fix(es):
Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qtto a version that resolves this vulnerability.Fixed in 4.8.7-60.oe2203sp4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use QtXml's QDomDocument serialization and process deeply nested XML from an untrusted source are exposed to a denial-of-service condition.
What does an attacker need to exploit it?
An attacker needs to induce a user or application to process deeply nested untrusted XML. No privileges are required, but user interaction is required according to the supplied severity vector.
What is the impact of successful exploitation?
Successful exploitation can exhaust the application's stack through uncontrolled recursion and crash the application. The described impact is denial of service only.