CVE-2026-6210 Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash
An attacker can crash applications using Qt SVG by providing a crafted SVG image that triggers a type confusion and heap overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6210?
CVE-2026-6210 is a high-severity memory corruption vulnerability in Qt, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service).
This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
Which versions are affected by CVE-2026-6210?
Linux distribution packages (1)
qt6-svg openSUSE:Tumbleweed | All versions | 6.11.0-2.1 |
How do I fix CVE-2026-6210?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-6210 being exploited?
There is no known exploitation of CVE-2026-6210 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-6210, GHSA-mh4x-qpf6-hr3q, UBUNTU-CVE-2026-6210, openSUSE-SU-2026:10742-1.