CVE-2026-19248

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19248", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "Qt", "dateReserved": "2026-08-07T12:46:51.889Z", "datePublished": "2026-09-16T06:37:40.652Z", "dateUpdated": "2026-09-16T15:02:54.099Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-09-16T06:37:40.652Z"}, "title": "Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt", "datePublic": "2026-09-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-230", "descriptions": [{"lang": "en", "value": "CAPEC-230 Serialized Data with Nested Payloads"}]}], "affected": [{"vendor": "qt", "product": "qt", "modules": ["qtbase"], "versions": [{"status": "affected", "version": "2.2.0", "lessThanOrEqual": "6.8.8", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThanOrEqual": "6.11.1", "versionType": "python"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.</p>"}]}], "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/740427", "name": "dev patch", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L"}}], "source": {"advisory": "QVM-190", "discovery": "INTERNAL"}, "x_generator": {"engine": "Claude AI (Sonnet 4.6) - draft only, requires human validation before submission"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-16T15:02:45.117734Z", "id": "CVE-2026-19248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T15:02:54.099Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T15:02:45.117734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T15:02:50.368Z"}}], "cna": {"title": "Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt", "source": {"advisory": "QVM-190", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-230", "descriptions": [{"lang": "en", "value": "CAPEC-230 Serialized Data with Nested Payloads"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 7.1, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "qt", "modules": ["qtbase"], "product": "qt", "versions": [{"status": "affected", "version": "2.2.0", "versionType": "python", "lessThanOrEqual": "6.8.8"}, {"status": "affected", "version": "6.9.0", "versionType": "python", "lessThanOrEqual": "6.11.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-11T00:00:00.000Z", "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/740427", "name": "dev patch", "tags": ["patch"]}], "x_generator": {"engine": "Claude AI (Sonnet 4.6) - draft only, requires human validation before submission"}, "descriptions": [{"lang": "en", "value": "QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.", "supportingMedia": [{"type": "text/html", "value": "<p>QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "Qt", "dateUpdated": "2026-09-16T06:37:40.652Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19248", "state": "PUBLISHED", "dateUpdated": "2026-09-16T15:02:54.099Z", "dateReserved": "2026-08-07T12:46:51.889Z", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "datePublished": "2026-09-16T06:37:40.652Z", "assignerShortName": "Qt"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["qtbase"], "product": "qt", "vendor": "qt", "versions": [{"lessThanOrEqual": "6.8.8", "status": "affected", "version": "2.2.0", "versionType": "python"}, {"lessThanOrEqual": "6.11.1", "status": "affected", "version": "6.9.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input."}], "id": "CVE-2026-19248", "lastModified": "2026-09-18T19:21:34.307", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19248", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-16T15:02:45.117734Z", "version": "2.0.3"}}]}, "published": "2026-09-16T07:16:32.943", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtbase/+/740427"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"bugzilla": {"description": "qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing", "id": "2535011", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535011"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-776", "details": ["A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service (DoS) crash. By processing untrusted XML input, the affected system can become unresponsive, leading to a disruption of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-19248", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "qt6-qtbase", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "qt5-qtbase", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "qt5-qtbase", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "qt5-qtbase", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "qt5-qtbase", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "qt6-qtbase", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-16T06:37:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19248\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19248\nhttps://codereview.qt-project.org/c/qt/qtbase/+/740427"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,6.8.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.0,6.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "qt", "source": "cna", "vendor": "qt"}, "product": "qt", "vendor": "qt"}], "created": "2026-09-16T09:30:09.942454+00:00", "updated": "2026-09-18T12:15:06.773378+00:00", "vendors": ["qt", "qt$PRODUCT$qt"]}