Every CVE Search/ Get API key

CVE-2026-8168

Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

7.1 HighFix available

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Unchanged since Oct 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
CVE-2026-8168
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-674
Updated
2026-11-02
EUVDEUVD-2026-104329 7.1

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
EUVD-2026-104329
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4f98-277j-6qvj 7.1

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt...

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
GHSA-4f98-277j-6qvj
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-674
Updated
2026-11-02
NVD 7.1

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
CVE-2026-8168
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-8168 7.1

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
DEBIAN-CVE-2026-8168
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:80569 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:80569
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-8168 7.1

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
UBUNTU-CVE-2026-8168
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-110127 No score

CVE-2026-8168 affecting package qtsvg 6.6.1-3

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

Record
AZL-110127
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qtsvg
Azure Linux:3
 through 6.6.1-3 None known
qt6-svg
Debian:12
 All versions, plus listed versions
6.10.2-16.10.2-26.10.2-36.10.2-46.10.2-5
Show 30 moreShow less
6.10.2-66.10.2-76.10.2-86.10.2-96.11.2-16.11.2-26.4.2-26.4.2-36.4.2-46.6.0-16.6.0-26.6.1-16.6.2-16.6.2-26.7.2-16.7.2-26.7.2-36.7.2-46.7.2-56.7.2-66.8.2-16.8.2-26.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-36.9.2-46.9.2-5
 None known
qt6-svg
Debian:13
 All versions, plus listed versions
6.10.2-16.10.2-26.10.2-36.10.2-46.10.2-5
Show 14 moreShow less
6.10.2-66.10.2-76.10.2-86.10.2-96.11.2-16.11.2-26.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-36.9.2-46.9.2-5
 None known
qt6-svg
Debian:14
 before 6.11.2-2, plus listed versions
6.10.2-16.10.2-26.10.2-36.10.2-46.10.2-5
Show 13 moreShow less
6.10.2-66.10.2-76.10.2-86.10.2-96.11.2-16.8.2-36.9.1-16.9.1-26.9.2-16.9.2-26.9.2-36.9.2-46.9.2-5
6.11.2-2
qtsvg-opensource-src
Debian:12
 All versions, plus listed versions
5.15.10-15.15.10-25.15.12-15.15.13-15.15.13-2
Show 10 moreShow less
5.15.15-15.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-25.15.8-35.15.9-1
 None known
qtsvg-opensource-src
Debian:13
 All versions, plus listed versions
5.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-2
 None known
qtsvg-opensource-src
Debian:14
 All versions, plus listed versions
5.15.15-25.15.17-15.15.17-25.15.17-35.15.18-15.15.19-15.15.19-2
 None known
qt6
Red Hat:hummingbird:1
 before 0:6.11.2-1.1.hum1
0:6.11.2-1.1.hum1
qt6-filesystem
Red Hat:hummingbird:1
 before 0:6.11.2-1.1.hum1
0:6.11.2-1.1.hum1
qt6-rpm-macros
Red Hat:hummingbird:1
 before 0:6.11.2-1.1.hum1
0:6.11.2-1.1.hum1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
qt6-srpm-macros
Red Hat:hummingbird:1
 before 0:6.11.2-1.1.hum1
0:6.11.2-1.1.hum1
qtsvg-opensource-src
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.4.2-2build15.5.1-2build15.5.1-2ubuntu0.1~esm1
 None known
qtsvg-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1-25.9.2-25.9.2-35.9.3-0ubuntu15.9.4-0ubuntu15.9.5-0ubuntu15.9.5-0ubuntu1.15.9.5-0ubuntu1.1+esm1
 None known
qtsvg-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4-15.12.5-25.12.5-2build15.12.8-0ubuntu15.12.8-0ubuntu1+esm1
 None known
qt6-svg
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2-2ubuntu16.2.4-1ubuntu1
 None known
qtsvg-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.2-35.15.2-45.15.3-15.15.3-1ubuntu0.1~esm1
 None known
qt6-svg
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2-4ubuntu16.4.2-4ubuntu26.4.2-4ubuntu3
 None known
qtsvg-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10-25.15.12-15.15.12-1build15.15.12-1build25.15.13-1
 None known
qt6-svg
Ubuntu:26.10
 All versions, plus listed versions
6.10.2-26.10.2-8ubuntu16.10.2-96.11.2-1
 None known
qtsvg-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.18-15.15.19-2
 None known
qt6-svg
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2-16.9.2-46.9.2-56.10.2-2
 None known
qtsvg-opensource-src
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17-15.15.17-25.15.17-35.15.18-1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-8168 is a high vulnerability (CVSS 7.1) in Qt, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in qt6-svg 6.11.2-2.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open