CVE-2026-6210: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in Qt
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
AI Analysis
Technical Summary
CVE-2026-6210 is a type confusion vulnerability in the Qt SVG module. When processing SVG marker references, the renderer retrieves a node by its id and casts it to QSvgMarker* without confirming the node's actual type. If a non-marker element, such as a <line> element, references itself as a marker, this leads to an out-of-bounds heap read caused by the size difference between QSvgLine and QSvgMarker objects. This is followed by endless recursion that bypasses the marker recursion guard due to incorrect virtual dispatch, ultimately causing an application crash (denial of service). The vulnerability affects Qt SVG versions >=6.7.0 <6.8.8 and >=6.9.0 <6.11.1.
Potential Impact
An attacker can cause a denial of service by triggering an application crash through a crafted SVG image exploiting the type confusion in marker reference processing. There is no indication of code execution or data disclosure. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, avoid processing untrusted SVG images in affected Qt SVG versions.
CVE-2026-6210: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in Qt
Description
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
CVSS v4.0
Score 8.7high
Affected software
pkg:maven/org.qtproject/qt-svgRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6210 is a type confusion vulnerability in the Qt SVG module. When processing SVG marker references, the renderer retrieves a node by its id and casts it to QSvgMarker* without confirming the node's actual type. If a non-marker element, such as a <line> element, references itself as a marker, this leads to an out-of-bounds heap read caused by the size difference between QSvgLine and QSvgMarker objects. This is followed by endless recursion that bypasses the marker recursion guard due to incorrect virtual dispatch, ultimately causing an application crash (denial of service). The vulnerability affects Qt SVG versions >=6.7.0 <6.8.8 and >=6.9.0 <6.11.1.
Potential Impact
An attacker can cause a denial of service by triggering an application crash through a crafted SVG image exploiting the type confusion in marker reference processing. There is no indication of code execution or data disclosure. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, avoid processing untrusted SVG images in affected Qt SVG versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TQtC
- Date Reserved
- 2026-04-13T12:16:27.416Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fb2ed6cbff5d8610dc7fed
Added to database: 05/06/2026, 12:06:46 UTC
Last enriched: 07/29/2026, 21:36:42 UTC
Last updated: 07/31/2026, 21:26:44 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.