Every CVESearch/Get API key

CVE-2026-11573

Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

7.1 HighFix available

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.39%Up 0.1 points since Sep 9, 2026
90%50%10%1%

What each source reports

CVE List Score used7.1

Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
CVE-2026-11573
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-674
Updated
2026-11-02
EUVDEUVD-2026-727177.1

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
EUVD-2026-72717
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m72v-p257-4w4p7.1

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted...

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).

Record
GHSA-m72v-p257-4w4p
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-674
Updated
2026-11-02
NVD7.1

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
CVE-2026-11573
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-115737.1

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
DEBIAN-CVE-2026-11573
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-44957.1

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.(CVE-2026-11573)

Record
OESA-2026-4495
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 17 moreShow less
OSVOESA-2026-44967.1

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.(CVE-2026-11573)

Record
OESA-2026-4496
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-46127.1

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.(CVE-2026-11573)

Record
OESA-2026-4612
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-47437.1

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4743
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/RE:L/U:X
Updated
2026-11-11
OSVOESA-2026-47447.1

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4744
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/RE:L/U:X
Updated
2026-11-11
OSVOESA-2026-47457.1

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4745
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/RE:L/U:X
Updated
2026-11-11
OSVOESA-2026-47467.1

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4746
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/RE:L/U:X
Updated
2026-11-11
OSVOESA-2026-47957.1

qt security update

Qt (pronounced as &quot;cute&quot;, not &quot;cu-tee&quot;) is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo or BB10, and on embedded devices. Ports for Android (Necessitas) and iOS are also in development

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4795
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-11
OSVOESA-2026-47967.1

qt security update

Qt (pronounced as &quot;cute&quot;, not &quot;cu-tee&quot;) is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo or BB10, and on embedded devices. Ports for Android (Necessitas) and iOS are also in development

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4796
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-11
OSVOESA-2026-47977.1

qt security update

Qt (pronounced as &quot;cute&quot;, not &quot;cu-tee&quot;) is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo or BB10, and on embedded devices. Ports for Android (Necessitas) and iOS are also in development

Security Fix(es):

Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).(CVE-2026-11573)

Record
OESA-2026-4797
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-11
OSVRHSA-2026:746537.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:74653
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:845827.5

Red Hat Security Advisory: qt6-qtbase security update

Record
RHSA-2026:84582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRLSA-2026:870827.5

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

  • qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)

  • qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:87082
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:939247.5

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

  • qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)

  • qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:93924
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2026-115737.1

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
UBUNTU-CVE-2026-11573
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:87082No score

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

  • qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
  • qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:87082
Updated
2026-11-02
OSVALSA-2026:93924No score

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

  • qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
  • qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:93924
Updated
2026-11-03
OSVAZL-100947No score

CVE-2026-11573 affecting package qtbase for versions less than 6.6.3-6

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Record
AZL-100947
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtbase
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-common
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-devel
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-examples
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-gui
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-mysql
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-odbc
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-postgresql
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-private-devel
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
qt5-qtbase-static
AlmaLinux:9
From an advisory covering 2 CVEs
before 5.15.9-11.el9_8.2
5.15.9-11.el9_8.2
Show 68 moreShow less
Affected packages
PackageAffectedFixed
qt5-qtbase
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-common
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-devel
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-examples
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-gui
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-mysql
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-odbc
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-postgresql
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-private-devel
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qt5-qtbase-static
AlmaLinux:8
From an advisory covering 2 CVEs
before 5.15.3-10.el8_10
5.15.3-10.el8_10
qtbase
Azure Linux:3
before 6.6.3-6
6.6.3-6
qt6-base
Debian:12
All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12
Show 45 moreShow less
6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.1+dfsg-46.6.1+dfsg-56.6.1+dfsg-6
None known
qt6-base
Debian:13
before 6.8.2+dfsg-5
6.8.2+dfsg-5
qt6-base
Debian:14
before 6.8.2+dfsg-5
6.8.2+dfsg-5
qtbase-opensource-src
Debian:12
All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5
Show 45 moreShow less
5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-25.15.9+dfsg-3
None known
qtbase-opensource-src
Debian:13
All versions, plus listed versions
5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1
Show 14 moreShow less
5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-5
None known
qtbase-opensource-src
Debian:14
All versions, plus listed versions
5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2
Show 13 moreShow less
5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-5
None known
qt6-qtbase
openEuler:24.03-LTS-SP4
before 6.5.2-16.oe2403sp4
6.5.2-16.oe2403sp4
qt6-qtbase
openEuler:24.03-LTS-SP3
before 6.5.2-16.oe2403sp3
6.5.2-16.oe2403sp3
qt6-qtbase
openEuler:24.03-LTS-SP1
before 6.5.2-16.oe2403sp1
6.5.2-16.oe2403sp1
qt5-qtbase
openEuler:22.03-LTS-SP4
before 5.15.2-22.oe2203sp4
5.15.2-22.oe2203sp4
qt5-qtbase
openEuler:24.03-LTS-SP1
before 5.15.10-19.oe2403sp1
5.15.10-19.oe2403sp1
qt5-qtbase
openEuler:24.03-LTS-SP3
before 5.15.10-19.oe2403sp3
5.15.10-19.oe2403sp3
qt5-qtbase
openEuler:24.03-LTS-SP4
before 5.15.10-19.oe2403sp4
5.15.10-19.oe2403sp4
qt
openEuler:24.03-LTS-SP3
before 4.8.7-68.oe2403sp3
4.8.7-68.oe2403sp3
qt
openEuler:24.03-LTS-SP4
before 4.8.7-68.oe2403sp4
4.8.7-68.oe2403sp4
qt
openEuler:22.03-LTS-SP4
before 4.8.7-60.oe2203sp4
4.8.7-60.oe2203sp4
qt6-qtbase
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-common
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-devel
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-examples
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-gui
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-ibase
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-mysql
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-odbc
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-postgresql
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-private-devel
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase-static
Red Hat:hummingbird:1
before 0:6.11.2-3.hum1
0:6.11.2-3.hum1
qt6-qtbase
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-common
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-debugsource
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-devel
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-devel-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-examples-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-gui
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-gui-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-mysql
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-mysql-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-odbc
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-odbc-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-postgresql
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-postgresql-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-tests-debuginfo
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-examples
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-private-devel
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt6-qtbase-static
Red Hat:enterprise_linux_eus:10.0
before 0:6.8.1-9.el10_0.1
0:6.8.1-9.el10_0.1
qt5-qtbase
Rocky Linux:9
From an advisory covering 2 CVEs
before 0:5.15.9-11.el9_8.2
0:5.15.9-11.el9_8.2
qt5-qtbase
Rocky Linux:8
From an advisory covering 2 CVEs
before 0:5.15.3-10.el8_10
0:5.15.3-10.el8_10
qtbase-opensource-src
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2
Show 15 moreShow less
5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2
None known
qtbase-opensource-src
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3
Show 12 moreShow less
5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2
None known
qtbase-opensource-src
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1
Show 6 moreShow less
5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4
None known
qt6-base
Ubuntu:22.04:LTS
All versions, plus listed versions
6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1
None known
qtbase-opensource-src
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3
Show 8 moreShow less
5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3
None known
qt6-base
Ubuntu:24.04:LTS
All versions, plus listed versions
6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5
None known
qtbase-opensource-src
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1
Show 4 moreShow less
5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1
None known
qtbase-opensource-src
Ubuntu:26.10
All versions, plus listed versions
5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2
None known
qtbase-opensource-src
Ubuntu:26.04:LTS
All versions, plus listed versions
5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1
None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
factsOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-11573 is a high vulnerability (CVSS 7.1) in Qt, published September 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in qtbase 6.6.3-6.

References

Show 30 moreShow less
This page doesn't list everything

Left out here: 40 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open