Qt SVG CVE-2026-8168

Exploitation requires that a Qt application built against the QtSvg module parse or render an attacker-supplied SVG file containing deeply nested elements; the specific trigger is the SVG parser/renderer recursing on nested markup until the stack is exhausted. The key limiting factor is user/application interaction (CVSS UI:P): an attacker cannot trigger this remotely without the victim's application actually loading the malicious SVG, so delivery depends on a workflow that feeds untrusted SVG into QtSvg (e.g. image preview, document rendering, web/chat content). No authentication is required per the CVSS vector (PR:N), and no special non-default configuration is indicated - any application that renders untrusted SVG through QtSvg is exposed. Impact is limited to availability (application crash); there is no confidentiality or integrity effect and no code execution.

This is a denial-of-service-only issue with a realistic but bounded risk profile. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 7.1 (High) driven ENTIRELY by availability impact (VA:H); confidentiality and integrity are explicitly N, consistent with a CWE-674 uncontrolled-recursion stack-exhaustion crash rather than code execution. The vector is network-reachable and needs no privileges, but UI:P indicates passive user interaction is required - a victim must open, load, or render a malicious SVG, so this is not a self-propagating or wormable condition. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data; per the input there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a credible, easy-to-trigger crash bug worth patching (vendor fix is available and the recursion class is trivially reproducible), but it is NOT a top-tier emergency - the impact ceiling is an application crash with no data compromise, and exploitation depends on getting a victim to process attacker-supplied SVG content. Note the 7.1 'High' rating overstates operational urgency because it reflects availability loss only; prioritize behind any confidentiality/integrity or actively-exploited issues.

An attacker crafts an SVG file containing deeply nested elements and delivers it to a victim through a channel where a Qt/QtSvg-based application will parse or render it - for example an email attachment, a chat image, a web resource, or a document thumbnail. When the application loads the SVG, the parser/renderer recurses without bound and exhausts the stack, crashing the application (denial of service). No public exploit is identified at time of analysis, but the condition is trivially reproducible since it requires only a malformed-but-valid SVG, not memory-corruption primitives.