This vulnerability (CVE-2026-19248) in Qt arises from uncontrolled recursion in the QDomDocument XML parser. When processing maliciously crafted XML input, the parser can enter a recursive loop that exhausts resources and causes a denial-of-service crash. The flaw is remotely triggerable without authentication or user interaction, affecting Qt versions >=2.2.0 <=6.8.8 and >=6.9.0 <=6.11.1. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on availability.

Successful exploitation results in a denial-of-service condition by crashing the application using the vulnerable QDomDocument XML parser. This can disrupt services relying on Qt XML processing. There is no indication of confidentiality or integrity impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted XML input with the vulnerable Qt versions or implement input validation and resource limits to mitigate potential denial-of-service.