CVE-2026-78253
Received Received - Intake

Uncontrolled Recursion in Qt QXmlStreamReader

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: TQtC

Description
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-78253
EUVD
EUVD-2026-85238

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qt_group qt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion flaw in Qt Group's QXmlStreamReader::readElementText() function. It allows attackers to trigger excessive recursive calls by providing a specially crafted XML document, leading to stack exhaustion and application crashes.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of Qt and analyzing XML parsing operations. Inspect applications using Qt for XML processing and monitor for stack exhaustion crashes during XML parsing. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause denial of service by crashing applications that process XML files. If exploited, it may lead to unexpected downtime, data processing interruptions, or service unavailability for systems relying on Qt's XML parsing.

Compliance Impact

This vulnerability causes a denial of service via stack exhaustion, which could disrupt services handling sensitive data. GDPR requires data processing integrity and availability, while HIPAA mandates safeguards against service disruptions. A crash could impact compliance by failing to maintain system availability for protected data.

Mitigation Strategies

Update Qt to the latest patched version. If updating is not possible, disable XML parsing in affected applications or implement strict input validation for XML data. Monitor applications for crashes during XML processing as a potential sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart