QT vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-16762 An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making theHigh 8.7 · Oct 23, 2026
• CVE-2026-8168 Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application craHigh 7.1 · Oct 19, 2026
• CVE-2026-95509 Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounHigh 8.8 · Sep 29, 2026
• CVE-2026-19248 QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.High 7.1 · Sep 16, 2026
• CVE-2026-11573 Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase).High 7.1 · Sep 8, 2026
• CVE-2026-12593 The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an APIHigh 8.7 · Jul 9, 2026
• CVE-2026-6210 A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.High 8.7 · May 6, 2026
• CVE-2025-14576 Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage comHigh 7.4 · Apr 30, 2026
• CVE-2025-12385 Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, LHigh 8.7 · Dec 3, 2025
• CVE-2025-6338 There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.Critical 9.2 · Oct 16, 2025
• CVE-2025-10729 The module will parse a <pattern> node which is not a child of a structural node.Critical 9.4 · Oct 3, 2025
• CVE-2025-10728 When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoSCritical 9.4 · Oct 3, 2025
• CVE-2025-5455 An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.High 8.4 · Jun 2, 2025
• CVE-2025-4211 Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows SHigh 7.3 · May 16, 2025
• CVE-2024-39936 An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3.High 8.6 · Jul 4, 2024
• CVE-2024-36048 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses Critical 9.8 · May 18, 2024
• CVE-2023-37369 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string thaHigh 7.5 · Aug 20, 2023
• CVE-2023-38197 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.High 7.5 · Jul 12, 2023
• CVE-2023-32763 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.High 7.5 · May 28, 2023
• CVE-2023-24607 Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4.High 7.5 · Apr 14, 2023
• CVE-2021-3481 A flaw was found in Qt.High 7.1 · Aug 22, 2022
• CVE-2022-25634 Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.High 7.5 · Mar 2, 2022
• CVE-2022-25255 In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not fouHigh 7.8 · Feb 16, 2022
• CVE-2021-38593 Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::sHigh 7.5 · Aug 11, 2021
• CVE-2020-24742 An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbiHigh 7.8 · Aug 9, 2021