CVE-2026-16762— Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
Quick assessment
Affected
qt qt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
如果攻击者能够向使用 QXmlStreamReader 的应用程序提供特制的 XML 文档，则可能在解析过程中导致 CPU 资源被过度消耗，从而使应用程序无响应（拒绝服务）。利用该漏洞仅需应用程序解析由攻击者控制的 XML 内容，无需任何身份验证、特权或除接收输入之外的用户交互。此漏洞不会导致机密性或完整性受损，即不会发生数据泄露、数据篡改或代码执行；其影响范围仅限于受影响的进程。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16762
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
Source: CVE Program / CVE List V5
Vulnerability Description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-16762
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16762
请登录查看更多情报信息。
Other References for CVE-2026-16762 (3)
IV. Related Vulnerabilities
Same product: qt
-
CVE-2026-95620
Use-after-free vulnerability in QNetworkAccessManager HTTP/2 -
CVE-2026-105923
Null-pointer dereference in QTriangulator reachable through -
CVE-2026-101201
QBinaryJson::fromBinaryData() integer overflow leading to OO -
CVE-2026-8168
Denial-of-service vulnerability in the SVG parser and render -
CVE-2026-79680
Authentication bypass vulnerability in the password authenti
Same vendor: qt
-
CVE-2026-95620
Use-after-free vulnerability in QNetworkAccessManager HTTP/2 -
CVE-2026-105923
Null-pointer dereference in QTriangulator reachable through -
CVE-2026-101201
QBinaryJson::fromBinaryData() integer overflow leading to OO -
CVE-2026-8168
Denial-of-service vulnerability in the SVG parser and render -
CVE-2026-94370
Memory corruption (double free / use-after-free) vulnerabili
Same weakness: CWE-407
-
CVE-2026-89314
Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS -
CVE-2026-115352
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Bracke -
CVE-2026-115347
Mistune before 3.3.0 Quadratic Denial of Service via parse_l -
CVE-2026-115319
fzf 0.36.0 through 0.74.5 Denial of Service via maskActionCo -
CVE-2026-96643
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic t
V. Comments for CVE-2026-16762
No comments yet