CVE-2026-16762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16762", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-07-23T14:05:09.271Z", "datePublished": "2026-10-23T08:58:40.028Z", "dateUpdated": "2026-10-23T10:56:05.830Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-10-23T08:58:40.028Z"}, "title": "Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-229", "descriptions": [{"lang": "en", "value": "CAPEC-229 Serialized Data Parameter Blowup"}]}], "affected": [{"vendor": "qt", "product": "qt", "modules": ["qtbase"], "versions": [{"status": "unknown", "version": "0", "lessThan": "4.3.0", "versionType": "python"}, {"status": "affected", "version": "4.3.0", "lessThan": "6.8.9", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThan": "6.11.2", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndExcluding": "6.11.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndExcluding": "6.11.2"}]}]}], "descriptions": [{"lang": "en", "value": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An attacker able to supply a crafted XML document to an application using <code>QXmlStreamReader</code> can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process.</p>"}]}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-16762:", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtbase/+/738885", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qtbase/+/738901", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "PRESENT", "Automatable": "YES", "Recovery": "AUTOMATIC", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16762", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T10:43:53.436456Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T10:56:05.830Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16762", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T10:43:53.436456Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T10:50:31.361Z"}}], "cna": {"title": "Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-229", "descriptions": [{"lang": "en", "value": "CAPEC-229 Serialized Data Parameter Blowup"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 8.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "qt", "modules": ["qtbase"], "product": "qt", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.3.0", "versionType": "python"}, {"status": "affected", "version": "4.3.0", "lessThan": "6.8.9", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThan": "6.11.2", "versionType": "python"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-16762:", "tags": ["vendor-advisory"]}, {"url": "https://codereview.qt-project.org/c/qt/qtbase/+/738885", "tags": ["patch"]}, {"url": "https://codereview.qt-project.org/c/qt/qtbase/+/738901", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker able to supply a crafted XML document to an application using <code>QXmlStreamReader</code> can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.9", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.9.0"}, {"criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.9", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.9.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-10-23T08:58:40.028Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16762", "state": "PUBLISHED", "dateUpdated": "2026-10-23T10:56:05.830Z", "dateReserved": "2026-07-23T14:05:09.271Z", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "datePublished": "2026-10-23T08:58:40.028Z", "assignerShortName": "Qt"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["qtbase"], "product": "qt", "vendor": "qt", "versions": [{"lessThan": "4.3.0", "status": "unknown", "version": "0", "versionType": "python"}, {"lessThan": "6.8.9", "status": "affected", "version": "4.3.0", "versionType": "python"}, {"lessThan": "6.11.2", "status": "affected", "version": "6.9.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process."}], "id": "CVE-2026-16762", "lastModified": "2026-10-23T19:45:03.547", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16762", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-23T10:43:53.436456Z", "version": "2.0.3"}}]}, "published": "2026-10-23T09:17:06.647", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtbase/+/738885"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtbase/+/738901"}, {"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-16762:"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,6.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.0,6.11.2)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "qt", "source": "cna", "vendor": "qt"}, "product": "qt", "vendor": "qt"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "qtbase", "vendor": "qt"}], "created": "2026-10-23T10:30:08.685541+00:00", "updated": "2026-10-23T10:30:09.098774+00:00", "vendors": ["qt", "qt$PRODUCT$qt", "qt$PRODUCT$qtbase"]}