CVE-2026-8168
Received Received - Intake

Uncontrolled Recursion in Qt SVG Module Causes DoS

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: TQtC

Description
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-8168
EUVD
EUVD-2026-104329

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt qt 4.1.0
qt qt 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg). Attackers can exploit it by providing a crafted SVG file with deeply nested elements, causing a denial of service through stack exhaustion, which leads to application crashes.

Impact Analysis

This vulnerability can cause applications using QtSvg to crash, leading to denial of service. Users may experience application instability or complete shutdown when processing malicious SVG files.

Compliance Impact

This vulnerability causes a denial of service via application crash due to stack exhaustion, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Update QtSvg to the latest patched version to prevent stack exhaustion from crafted SVG files. Avoid processing untrusted SVG files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart