CVE-2026-8168— Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Quick assessment
Affected
qt qt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Qt Group 的 Qt 框架中，QtSvg 模块的 SVG 解析器和渲染器存在不受控的递归问题。攻击者可利用包含深度嵌套元素的特制 SVG 文件，导致服务拒绝（通过栈耗尽引发应用程序崩溃）。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-8168
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-8168
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8168
请登录查看更多情报信息。
Other References for CVE-2026-8168 (11)
IV. Related Vulnerabilities
Same product: qt
-
CVE-2026-79680
Authentication bypass vulnerability in the password authenti -
CVE-2026-78253
Denial-of-service (stack-exhaustion) vulnerability in QXmlSt -
CVE-2026-79616
Out-of-bounds read vulnerability in Context2D.path and PathS -
CVE-2026-76151
Out-of-bounds read (buffer over-read) vulnerability in HTTP -
CVE-2026-19248
Unbounded recursion vulnerability in the QDomNode destructor
Same vendor: qt
-
CVE-2026-94370
Memory corruption (double free / use-after-free) vulnerabili -
CVE-2026-19395
An empty <img> attribute value in styled text triggers a par -
CVE-2026-95509
Out-of-bounds read vulnerability in string formatting impact -
CVE-2026-79680
Authentication bypass vulnerability in the password authenti -
CVE-2026-78253
Denial-of-service (stack-exhaustion) vulnerability in QXmlSt
Same weakness: CWE-674
-
CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack e -
CVE-2026-112368
Unbounded Recursion in phongo_bson_visit_document/visit_arra -
CVE-2026-111923
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enroll -
CVE-2026-55862
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM func -
CVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/
V. Comments for CVE-2026-8168
No comments yet