Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Qt framework's Core module, specifically its QXmlStreamReader XML parser, is affected. A crafted XML document supplied to an application using this parser can cause it to consume excessive CPU and become unresponsive, though no data is exposed or altered.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Affected versions
- qt qt
From 4.3.0 · fixed in 6.8.9; From 6.9.0 · fixed in 6.11.2