Qt EUVD-2026-85238

Exploitation requires the target application to be built on Qt (versions 5.0.0-6.8.8 or 6.9.0-6.11.1) AND to call QXmlStreamReader::readElementText() on attacker-controlled or attacker-influenced XML input. The attacker must supply a crafted XML document with sufficient element nesting to exhaust the stack; per the CVSS 4.0 vector, this involves an attack requirement (AT:P) and passive user interaction (UI:P), i.e., the user or application must process the malicious document. Limiting factors: applications that never parse untrusted XML, or that use a different parsing API, are not exposed; impact is a recoverable single-application crash (R:U) with no code execution or data compromise.

This is a genuinely low-priority issue despite Qt's massive install base. The reported CVSS 4.0 base is only 2.3, driven by availability-only impact (VC:N/VI:N/VA:H) plus threat/supplemental modifiers (E:U = no known exploit, R:U = user-recoverable via restart, U:Green). The attack vector is network (AV:N) but exploitation carries an attack requirement (AT:P) and passive user interaction (UI:P), meaning the target application must actually feed an attacker-supplied XML document into QXmlStreamReader::readElementText(). Impact is confined to a single application crash from stack exhaustion - no memory corruption, no code execution, no confidentiality or integrity loss (CWE-674 uncontrolled recursion). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation. The one signal that raises the profile is prevalence: Qt underpins an enormous number of desktop, embedded, and automotive applications, so the theoretical exposure is wide - but real risk is gated by whether a given app parses untrusted XML with the affected API, and the worst case is a recoverable crash. Net: real but low priority; patch on normal cadence.

An attacker crafts an XML document with deeply nested elements and delivers it to a Qt-based application that parses it with QXmlStreamReader::readElementText() (e.g., a document opened by the user or an XML payload received over the network). Parsing recurses without bound until the stack is exhausted and the application crashes. No public exploit code is identified at time of analysis, and the impact is limited to a denial of service of that single application.