CVE-2026-8168: CWE-674 Uncontrolled Recursion in qt

The vulnerability CVE-2026-8168 arises from uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg). Specifically, when processing a crafted SVG file containing deeply nested elements, the recursion depth can exhaust the stack, leading to an application crash (denial of service). This affects Qt versions from 4.1.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.2. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability does not involve confidentiality, integrity, or availability impacts beyond the denial of service.

An attacker can cause a denial of service by crashing applications using the vulnerable Qt SVG module through a crafted SVG file with deeply nested elements. This results in stack exhaustion and application termination. There is no indication of code execution, data leakage, or other impacts beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or malicious SVG files with deeply nested elements in affected Qt versions.