Executive brief
Qt's XML document library can crash when serializing deeply nested XML documents. An attacker who can provide a specially crafted XML file with excessive nesting levels can cause the application to exhaust its call stack and crash, resulting in denial of service. This affects any application using Qt's XML parsing and serialization features.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module. QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually without enforcing any depth limit or configurable recursion bound, consuming one stack frame per element nesting level. A document with deeply nested elements parses successfully but causes stack exhaustion during serialization via QDomDocument::toByteArray(), toString(), toCString(), QDomNode::save(), or the << operator with QTextStream. The attack is reachable from any code that serializes user-controlled or untrusted XML, requiring only that the application call one of the affected serialization methods. This is a denial of service issue with no code execution or memory disclosure.
Affected products
- The Qt Company QtXml Qt 4.0 and later
Timeline
- 2026-09-08: disclosed