CVE-2026-16762
Received Received - Intake

XML Parsing Denial of Service in Qt QXmlStreamReader

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: TQtC

Description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-16762
EUVD
EUVD-2026-108655

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt qt 4.3.0
qt qt 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to cause excessive CPU usage by providing a specially crafted XML document to an application using QXmlStreamReader. The application becomes unresponsive due to the high CPU consumption during XML parsing. Exploitation requires only that the application parse the attacker-controlled XML input; no authentication or privileges are needed.

Detection Guidance

Monitor for applications using QXmlStreamReader that experience sudden CPU spikes or become unresponsive when processing XML input. Check logs for unusually large or malformed XML files being parsed.

Impact Analysis

The impact is limited to denial of service (DoS) for the affected application. The application may become unresponsive or crash due to high CPU consumption. There is no risk of data disclosure, data modification, or code execution. The attack requires only that the application parse the malicious XML input.

Compliance Impact

This vulnerability primarily impacts availability of the affected application, which could lead to service disruptions. While it does not directly affect confidentiality or integrity, prolonged downtime may violate availability requirements in standards like GDPR or HIPAA. Organizations should address this to maintain compliance with availability obligations.

Mitigation Strategies

Update Qt to a patched version that fixes the issue. If updating is not possible, restrict network access to applications using QXmlStreamReader or implement input validation to limit XML size and complexity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart