PT-2026-37624 · Qt Company · Qt Svg

Tqtc · Published 2026-05-06 · Updated 2026-05-10 · CVE-2026-6210

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Qt SVG versions 6.7.0 through 6.8.7 Qt SVG versions 6.9.0 through 6.11.0

Description A type confusion issue in Qt SVG allows an attacker to cause an application crash through a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. If a non-marker element, such as a <line> element, references itself as a marker, it triggers an out-of-bounds heap read due to the size difference between QSvgLine and QSvgMarker. This is followed by endless recursion that bypasses the marker recursion guard via incorrect virtual dispatch, resulting in a denial of service.

Recommendations Update Qt SVG versions 6.7.0 through 6.8.7 to version 6.8.8. Update Qt SVG versions 6.9.0 through 6.11.0 to version 6.11.1.

Fix

DoS

Heap Based Buffer Overflow

Type Confusion

Weakness Enumeration

CWE-122

CWE-843

Related Identifiers

CVE-2026-6210

OPENSUSE-SU-2026:10742-1

Affected Products

Qt Svg

References · 11

• https://cve.org/CVERecord?id=CVE-2026-6210 · Security Note
• https://ubuntu.com/security/CVE-2026-6210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6210 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10742-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6210 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6210 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-6210 · Vendor Advisory
• https://codereview.qt-project.org/c/qt/qtsvg/+/724887 · Note
• https://suse.com/security/cve/CVE-2026-6210 · Note
• https://t.me/CVEtracker/52859 · Telegram Post
• https://issues.oss-fuzz.com/issues/496327371 · Note