EUVD-2026-48254
GHSA-7xx4-xq65-r6v3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures that exploitation depends on the application serializing attacker-controlled data through QDom, a condition beyond the attacker's direct control; no confidentiality or availability impact applies.
Primary rating from Vendor (TQtC).
CVSS VectorVendor: TQtC
Lifecycle Timeline
2DescriptionCVE.org
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
AnalysisAI
XML injection in Qt's QDom serialization component (versions 4.0.0 through 6.11) allows untrusted text passed to comment, CDATA, and processing-instruction nodes to break out of those structures and inject arbitrary XML markup into serialized output, because the default InvalidDataPolicy (AcceptInvalidChars) does not escape node terminators such as '-->', ']]>', or '?>'. The CVSS 4.0 score of 2.9 reflects an attack timing prerequisite (AT:P) - only applications that actively pass attacker-controlled content through QDom serialization are exploitable; the Qt library itself is not a standalone attack surface. No public exploit is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 threat metric E:P suggests proof-of-concept code may exist.
Technical ContextAI
Qt's QDom module provides a W3C DOM-level API for constructing and serializing XML documents. Three node types - comments (<!-- -->), CDATA sections (<![CDATA[ ]]>), and processing instructions (<?target data?>) - each have specific ASCII terminator sequences that must be absent from their content to preserve well-formed XML structure. Qt's serializer defaults to the AcceptInvalidChars mode of InvalidDataPolicy, which writes user-supplied content verbatim without escaping or rejecting these terminators. CWE-91 (XML Injection, also known as Blind XPath Injection in its broader form) precisely captures this root cause: user-controlled data flows into an XML-generating function without proper output neutralization, enabling structural injection. The affected CPE is cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*, spanning all Qt releases from 4.0.0 through 6.11 across every platform Qt supports (Linux, Windows, macOS, embedded targets).
RemediationAI
Upgrade to Qt 6.12 or later, which resolves the missing escape logic for node terminator sequences in QDom comment, CDATA, and processing-instruction serialization. The patch is visible at https://codereview.qt-project.org/c/qt/qtbase/+/748323; note that this is a Qt code review submission - the packaged Qt 6.12 release should be sourced from the official Qt distribution channels. For applications that cannot upgrade immediately, apply input sanitization at the application boundary before passing untrusted data to QDom APIs: strip or reject '-->' sequences from content destined for comment nodes, ']]>' from CDATA content, and '?>' from processing-instruction data. As an alternative, consider switching the QDom InvalidDataPolicy away from the default AcceptInvalidChars mode so that invalid characters cause an error or are dropped - this prevents injection but may surface previously silent data quality issues. Applications that exclusively serialize trusted, internally generated content with no user-controlled values flowing into QDom comment, CDATA, or PI nodes are not at risk and do not require emergency remediation.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
Type confusion in Qt SVG renderer allows remote denial of service through malicious SVG images. Attackers can craft SVG
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allo
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today