Qt QXmlStreamReader CVE-2026-16762

The only precondition is that the target application uses Qt's QXmlStreamReader to parse XML that an attacker can influence (e.g. an uploaded, submitted, or fetched document); no authentication, privileges, or user interaction beyond ingesting the input are required. Exploitation is limited by whether the application actually exposes an attacker-reachable XML parsing path and whether input-size or timeout controls are in place; impact is contained to the affected process (availability of that one process), with no effect on confidentiality or integrity and no spread to other systems.

This is a denial-of-service-only flaw (CWE-407, inefficient algorithmic complexity) in Qt's QXmlStreamReader. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition with no attack requirements, and impact confined to availability (VA:H) with no confidentiality or integrity loss (VC:N/VI:N). The 8.7 'high' CVSS 4.0 score is driven almost entirely by that reachable availability impact, not by any system compromise. The vuln.today Decision label is 'this_week', which is an elevated-but-not-emergency priority consistent with a reachable DoS that is not known to be actively exploited. No EPSS score was provided, there is no CISA KEV listing, and the supplied references are a vendor advisory wiki entry and two qtbase patch code-reviews - not exploit code - so there is no public exploit identified at time of analysis. The practical risk is real for any service that parses attacker-influenced XML with QXmlStreamReader, but it is bounded: an attacker can hang or pin the affected process, not read data or execute code. The input 'RCE' tag conflicts with the description, which explicitly rules out code execution; treat the RCE label as erroneous and the issue as availability-only.

An attacker submits a specially crafted XML document to a network-facing application (for example an API endpoint, message handler, or file import feature) that uses Qt's QXmlStreamReader to parse it. The structure of the document triggers disproportionate CPU work during parsing, so a single small request pins a CPU core and makes the application unresponsive to legitimate users. No authentication or user interaction is required (AV:N/PR:N/UI:N), and no public exploit code has been identified at time of analysis.