Qt Patches High-Severity QXmlStreamReader DoS Flaw in Versions Through 6.11.1

CVE-2026-16762 is a denial-of-service flaw in the Qt XML stream parser within the qtbase component. Published by the Qt Project on October 23, 2026, the vulnerability lets an attacker send a crafted XML document that maxes out CPU usage and leaves any application parsing with QXmlStreamReader unresponsive.

The issue impacts Qt 4.3.0 through 6.8.8 and Qt 6.9.0 through 6.11.1. Status for versions prior to 4.3.0 is unknown, while QtXml and QDomDocument are unaffected.

Exploitation requires no authentication, privileges, or user interaction beyond having an application parse attacker-influenced XML. The advisory states there is no loss of confidentiality or integrity—meaning zero data disclosure, modification, or code execution—and the damage is restricted entirely to the affected process. The CVSS 4.0 score is 8.7 (High) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, reflecting a network-reachable, low-complexity attack with high availability impact.

To fix the bug, update to Qt 6.8.9, Qt 6.11.2, Qt 6.12.0 or later. If you cannot upgrade, apply patches manually. The dev branch requires changes 738885 and 738901. Qt 6.11 needs changes 746368 and 746369, and Qt 6.8 needs 746715 and 746717. Downloadable .diff files are also available for 6.11 and 6.8 in 0001 and 0002 pairs.

Until you patch, validate and size-limit untrusted XML at the ingress point by capping input size, limiting attribute counts, and enforcing parse timeouts.

Two other advisories accompanied this release: CVE-2026-96432 in QNetworkAccessManager and CVE-2026-105923 in QTriangulator, both null pointer dereferences.