CVE-2026-6210
Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
CVE-2026-6210- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-843, CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2026-27681
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
EUVD-2026-27681- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mh4x-qpf6-hr3q
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a...
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
GHSA-mh4x-qpf6-hr3q- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
CVE-2026-6210- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-122, CWE-843
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-6210
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
DEBIAN-CVE-2026-6210- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-6210
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
- Record
UBUNTU-CVE-2026-6210- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10742-1 No score
libQt6Svg6-6.11.0-2.1 on GA media
These are all security issues fixed in the libQt6Svg6-6.11.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10742-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-svgDebian:13 |
All versions, plus listed versions 6.10.2-16.10.2-26.10.2-36.10.2-46.10.2-5 Show 14 moreShow less6.10.2-66.10.2-76.10.2-86.10.2-96.11.2-16.11.2-26.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-36.9.2-46.9.2-5 |
None known |
qt6-svgDebian:14 |
before 6.10.2-6, plus listed versions 6.10.2-16.10.2-26.10.2-36.10.2-46.10.2-5 Show 8 moreShow less6.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-36.9.2-46.9.2-5 |
6.10.2-6 |
qt6-svgUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2-2ubuntu16.2.4-1ubuntu1 |
None known |
qt6-svgUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2-4ubuntu16.4.2-4ubuntu26.4.2-4ubuntu3 |
None known |
qt6-svgUbuntu:25.10 |
All versions, plus listed versions 6.8.3-0ubuntu16.9.2-1 |
None known |
qt6-svgUbuntu:26.10 |
All versions, plus listed versions 6.10.2-26.10.2-8ubuntu16.10.2-96.11.2-1 |
None known |
qt6-svgUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2-16.9.2-46.9.2-56.10.2-2 |
None known |
qt6-svgopenSUSE:Tumbleweed |
before 6.11.0-2.1 | 6.11.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6210 is a high vulnerability (CVSS 8.7) in Qt, published May 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in qt6-svg 6.10.2-6.
References
codereview.qt-project.org/c/qt/qtsvg/+/724887
issues.oss-fuzz.com/issues/496327371
nvd.nist.gov/vuln/detail/CVE-2026-6210
github.com/advisories/GHSA-mh4x-qpf6-hr3q
security-tracker.debian.org/tracker/CVE-2026-6210
ubuntu.com/security/CVE-2026-6210
cve.org/CVERecord?id=CVE-2026-6210
suse.com/security/cve/CVE-2026-6210