Qt XML CVE-2026-15037

Exploitation requires three concurrent application-layer conditions: (1) the application uses Qt 4.0.0 through 6.11 and calls QDom serialization APIs to write comment, CDATA, or processing-instruction nodes; (2) the content of those nodes originates from or is influenced by attacker-controlled input (e.g., user-supplied strings, external data feeds, network-received content); and (3) the application has not overridden the default InvalidDataPolicy from AcceptInvalidChars to a stricter mode. The AT:P (Attack Timing: Prerequisite) metric in the provided CVSS 4.0 vector formally encodes these prerequisites. Exploitation is bounded to integrity impact only - there is no path to confidentiality disclosure or denial of service from this vulnerability alone. Applications that use Qt for GUI rendering, multimedia, or network protocols without invoking QDom serialization on untrusted data are not exploitable. The vulnerability does not exist at the Qt library loading or linking layer - only at the serialization call site.

Multiple signals converge on a low-to-moderate real-world risk rating. The CVSS 4.0 base score of 2.9 incorporates AT:P (Attack Timing: Prerequisite), explicitly modeling that exploitation depends on a specific application-layer condition - the target application must serialize attacker-supplied text through one of the three vulnerable QDom node types. The threat metric E:P ('proof-of-concept exists') slightly elevates risk above purely theoretical, but no KEV listing confirms mass or targeted exploitation. EPSS data was not provided. The CVSS 4.0 impact metrics confirm the scope is narrow: VI:L (low integrity impact) with no confidentiality or availability impact (VC:N, VA:N). The practical risk to any given organization is therefore a function of their Qt application portfolio: organizations shipping Qt-based software that processes untrusted XML or user content through QDom have genuine integrity risk (malformed or malicious XML documents produced); organizations using Qt only for internal tooling or GUI rendering with no untrusted serialization path face negligible exposure. No conflicting signals are present - all available data consistently points to a low-severity, context-dependent issue.

An attacker interacts with a network-facing Qt application that accepts user-supplied text and serializes it into an XML document using QDom - for example, a CDATA section in a configuration or data export feature. By including the string ']]><maliciousElement/><![CDATA[' in their input, the attacker causes the CDATA terminator to be written unescaped, closing the legitimate CDATA node and injecting an arbitrary XML element into the document before reopening a new CDATA section. The E:P threat metric in the CVSS 4.0 vector suggests proof-of-concept code exists, making this a well-understood injection class that requires no advanced tradecraft once a vulnerable serialization path is identified.