---
id: CVE-2026-8168
title: Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
summary: >-
  Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module
  (QtSvg) in Qt Group Qt allows attackers to cause a denial of service
  (application crash via stack exhaustion) via a crafted SVG file with deeply
  nested elements.
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-674
vendor: qt
product: qt
affected:
  - qt >= 4.1.0 < 6.8.9
  - qt >= 6.9.0 < 6.11.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T14:27:04.849301Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:27:15.747Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-8168'
references:
  - url: >-
      https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:
    label: Propagate QSvgExtraStates variables to pattern and mask elements
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730591'
    label: Fix rendering causing stack overflow
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730501'
    label: Fix resolving paint servers going through stack overflow
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/731257'
    label: Fix stack overflow caused by recursive calls of destructors
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730892'
    label: Add a test for deeply nested SVG files
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/733245'
    label: Add baseline test for deeply nested elements
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/738811'
    label: 'Speed up QSvgStructureNode::releaseDescendants()'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730590'
    label: Fix stack overflow in detectCycles
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/743488'
    label: Use bottom tested loop in detectCycles()
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/748966'
    label: Apply and revert styles iteratively
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/756512'
    label: Propagate QSvgExtraStates variables to pattern and mask elements
tags:
  - cve.org
ingestedAt: '2026-10-19T13:28:55.891Z'
---

## Overview

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

## Affected

- `qt >= 4.1.0 < 6.8.9`
- `qt >= 6.9.0 < 6.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.