CVE-2026-15037 XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Attackers can inject arbitrary XML markup via untrusted text in QDom nodes, potentially leading to code execution or data exposure in applications using Qt XML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15037?
CVE-2026-15037 is a low-severity vulnerability in Qt, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Weakness: CWE-91
Which versions are affected by CVE-2026-15037?
Linux distribution packages (11)
qt6-qtbase Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-common Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-devel Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-examples Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-gui Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-ibase Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-mysql Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-odbc Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-postgresql Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-private-devel Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
qt6-qtbase-static Red Hat:hummingbird:1 | All versions | 0:6.11.2-3.1.hum1 |
How do I fix CVE-2026-15037?
Upgrade to a fixed version.
Is CVE-2026-15037 being exploited?
There is no known exploitation of CVE-2026-15037 in the wild and no public exploit code.
Sources
Also known as AZL-94116, DEBIAN-CVE-2026-15037, ECHO-ac3c-11a6-be31, GHSA-7xx4-xq65-r6v3, RHSA-2026:82382, UBUNTU-CVE-2026-15037.