CVE-2026-15037
Deferred Deferred - Pending Action

XML Injection in Qt XML Serialization

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: TQtC

Description
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-15037
EUVD
EUVD-2026-48254

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt qt From 4.0.0 (inc) to 6.11.0 (inc)
qt qt_xml to 6.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML injection issue in Qt XML versions 4.0.0 through 6.11. It occurs when untrusted text is serialized into XML nodes like comments, CDATA, or processing instructions. The problem is that node terminators are not escaped by default, allowing attackers to inject arbitrary XML markup.

Detection Guidance

Detecting this vulnerability requires checking the Qt XML version in use. Run 'qmake -v' or 'qt.conf' inspection to verify if your Qt version is below 6.12. Additionally, review application logs for XML serialization operations that may involve untrusted input.

Impact Analysis

This vulnerability could allow attackers to manipulate XML output, potentially leading to data corruption, unauthorized access, or denial of service. Applications using affected Qt XML versions may process maliciously crafted XML, causing unexpected behavior or security breaches.

Mitigation Strategies

Upgrade Qt to version 6.12 or later immediately. If upgrading is not possible, modify applications to escape XML special characters before serialization or switch to a different XML library that properly handles invalid data policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart