Executive brief
A vulnerability in the Qt SVG library, which is used by many applications to display vector graphics, could allow a malicious image to crash the software. By providing a specially crafted SVG file, an attacker can cause the application to stop responding or shut down unexpectedly. This primarily impacts the availability of services or desktop applications that process user-supplied images.
Technical details
A type confusion vulnerability exists in the Qt SVG renderer during the processing of SVG marker references. The renderer retrieves a node by its ID and casts it to a QSvgMarker pointer without verifying the actual node type. If a non-marker element, such as a <line>, references itself as a marker, it triggers an out-of-bounds heap read due to object size discrepancies. This leads to an endless recursion that bypasses the marker recursion guard via incorrect virtual dispatch, resulting in a denial-of-service (DoS) crash. The issue is addressed in versions 6.8.8 and 6.11.1.
Affected products
- Qt Group Qt SVG 6.7.0 to 6.8.7, 6.9.0 to 6.11.0
Timeline
- 2026-05-06: disclosed