CVE-2026-6210: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in The Qt Company Qt
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
AI Analysis
Technical Summary
This vulnerability arises from improper type checking in the Qt SVG renderer when handling marker references. Specifically, the renderer assumes that the referenced node is always a QSvgMarker*, but if the node is actually a different SVG element type (e.g., QSvgLine), the incorrect cast leads to an out-of-bounds heap read due to size differences between the object types. This is followed by endless recursion caused by incorrect virtual dispatch, bypassing recursion guards and ultimately crashing the application. The issue affects Qt SVG versions 6.7.0 up to but not including 6.8.8, and 6.9.0 up to but not including 6.11.1. The vulnerability is classified under CWE-843 (Access of Resource Using Incompatible Type) and CWE-122 (Heap-based Buffer Overflow).
Potential Impact
Successful exploitation causes an application crash resulting in denial of service. There is no indication of code execution or data corruption beyond the crash. The vulnerability can be triggered by processing a crafted SVG image containing a marker reference that points to a non-marker element referencing itself.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or malicious SVG images that could exploit this vulnerability. Monitor Qt Company advisories for updates regarding patches or workarounds.
CVE-2026-6210: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in The Qt Company Qt
Description
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a <line> element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker, followed by an endless recursion that bypasses the marker recursion guard through incorrect virtual dispatch. The result is an application crash (denial of service). This issue affects Qt SVG: from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper type checking in the Qt SVG renderer when handling marker references. Specifically, the renderer assumes that the referenced node is always a QSvgMarker*, but if the node is actually a different SVG element type (e.g., QSvgLine), the incorrect cast leads to an out-of-bounds heap read due to size differences between the object types. This is followed by endless recursion caused by incorrect virtual dispatch, bypassing recursion guards and ultimately crashing the application. The issue affects Qt SVG versions 6.7.0 up to but not including 6.8.8, and 6.9.0 up to but not including 6.11.1. The vulnerability is classified under CWE-843 (Access of Resource Using Incompatible Type) and CWE-122 (Heap-based Buffer Overflow).
Potential Impact
Successful exploitation causes an application crash resulting in denial of service. There is no indication of code execution or data corruption beyond the crash. The vulnerability can be triggered by processing a crafted SVG image containing a marker reference that points to a non-marker element referencing itself.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or malicious SVG images that could exploit this vulnerability. Monitor Qt Company advisories for updates regarding patches or workarounds.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TQtC
- Date Reserved
- 2026-04-13T12:16:27.416Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fb2ed6cbff5d8610dc7fed
Added to database: 5/6/2026, 12:06:46 PM
Last enriched: 5/6/2026, 12:21:21 PM
Last updated: 5/7/2026, 8:18:16 AM
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.