An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Qt
  • Qt
  • Qt5compat
  • Qt Framework
  • Qtbase

No data.

No data.

References
Link Providers
https://codereview.qt-project.org/c/qt/qt5compat/+/760219 cve-icon cve-icon
https://codereview.qt-project.org/c/qt/qt5compat/+/760220 cve-icon cve-icon
https://codereview.qt-project.org/c/qt/qt5compat/+/771290 cve-icon cve-icon
https://codereview.qt-project.org/c/qt/qt5compat/+/774512 cve-icon cve-icon
https://codereview.qt-project.org/c/qt/qt5compat/+/774513 cve-icon cve-icon
https://codereview.qt-project.org/c/qt/qt5compat/+/774632 cve-icon cve-icon
https://www.qt.io/security-advisories?search=CVE-2026-97845 cve-icon cve-icon
History

Sat, 14 Nov 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Qt qt Framework
Vendors & Products Qt qt Framework

Thu, 12 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
Description An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).
Title Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt
First Time appeared Qt
Qt qt
Qt qt5compat
Qt qtbase
Weaknesses CWE-674
CPEs cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*
Vendors & Products Qt
Qt qt
Qt qt5compat
Qt qtbase
References
Metrics cvssV4_0

{'score': 4.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/U:Green'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published: 2026-11-12T13:08:43.473Z

Updated: 2026-11-12T13:08:43.473Z

Reserved: 2026-09-25T05:24:04.653Z

Link: CVE-2026-97845

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-12T14:17:30.880

Modified: 2026-11-12T21:30:23.870

Link: CVE-2026-97845

cve-icon Redhat

No data.