CVE-2026-16762 Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-16762?
CVE-2026-16762 is a high-severity vulnerability in qt, published on 23 Oct 2026.
Official description
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
Weakness: CWE-407
Which versions are affected by CVE-2026-16762?
How do I fix CVE-2026-16762?
Upgrade to a fixed version.
Is CVE-2026-16762 being exploited?
There is no known exploitation of CVE-2026-16762 in the wild and no public exploit code.
Sources
Also known as AZL-111425, DEBIAN-CVE-2026-16762, ECHO-9e96-ce4f-470a, GHSA-3gxv-qxph-7hg3, UBUNTU-CVE-2026-16762.