Executive brief
Qt's QDomDocument is a library component used by applications to parse and process XML files. A flaw in its XML parsing logic allows an attacker to crash any application using this component by sending a specially crafted XML file, causing denial of service and disrupting normal operation.
Technical details
QDomDocument contains a denial-of-service vulnerability in its XML parsing logic that can be triggered remotely when processing untrusted XML input. The vulnerability allows an attacker to craft a malicious XML document that causes the parser to crash, resulting in a denial of service condition. Attack requires sending the malicious XML to an application that uses QDomDocument for parsing. The specific root cause and affected parsing components are described in Qt's code review at qt-project.org. Fix availability should be confirmed via Qt's official security advisories and patch releases.
Affected products
- Qt Qt <UNKNOWN>
Timeline
- 2026-09-16: disclosed