CVE-2026-8168
HighCVSS 7.1Summary
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt allows a crafted SVG file with deeply nested elements to cause stack exhaustion and application crash (denial of service).
Risk Assessment
An attacker can remotely crash an application processing SVG files, causing service unavailability. Systems handling untrusted SVG files are at risk.
Recommendation
Update Qt to a version containing the fix or restrict processing of untrusted SVG files. Also consider enforcing limits on element nesting depth.
Other vulnerabilities in Qt SVG
See all- CVE-2026-6210High
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. The issue occurs when processing SVG marker references, where the renderer does not verify the node type before casting.
- CVE-2025-14576High
Insufficient validation of node IDs in the Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. Although QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Original NVD description (English source)
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS