Skip to content
Sign in
8.7 High

CVE-2026-6210 A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image

Description

A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG:  from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.

Affected products and versions

Product Affected versions Fixed in
Qt 6.9 6.9.0 → < 6.11.1 6.11.1
Qt 6.7 6.7.0 → < 6.8.8 6.8.8
Qt 6.9 6.9.0 → < 6.11.1 6.11.1
Qt 6.7 6.7.0 → < 6.8.8 6.8.8

Other CVEs of Qt

The 13 CVEs of Qt →
CVE-2025-14575 An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework… 1.8 Low CVE-2025-14576 Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading… 7.4 High CVE-2025-12385 Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability… 8.7 High CVE-2025-6338 There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of… 9.2 Critical
Track this CVE