CVE-2026-8168
Fixed in a distro release EPSS <1%CVSS 7.1
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Products: qt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qt6-svg | no fix |
| Debian 12 | qtsvg-opensource-src | no fix |
| Debian 13 | qt6-svg | no fix |
| Debian 13 | qtsvg-opensource-src | no fix |
| Debian 14 | qt6-svg | 6.11.2-2 |
| Debian 14 | qtsvg-opensource-src | no fix |
| Red Hat hummingbird 1 | qt6 | 0:6.11.2-1.1.hum1 |
| Red Hat hummingbird 1 | qt6-filesystem | 0:6.11.2-1.1.hum1 |
| Red Hat hummingbird 1 | qt6-rpm-macros | 0:6.11.2-1.1.hum1 |
| Red Hat hummingbird 1 | qt6-srpm-macros | 0:6.11.2-1.1.hum1 |
| Ubuntu 22.04 LTS | qt6-svg | no fix |
| Ubuntu 24.04 LTS | qt6-svg | no fix |
| Ubuntu 24.04 LTS | qtsvg-opensource-src | no fix |
| Ubuntu 26.04 LTS | qt6-svg | no fix |
| Ubuntu 26.04 LTS | qtsvg-opensource-src | no fix |
| Ubuntu 26.10 | qt6-svg | no fix |
| Ubuntu 26.10 | qtsvg-opensource-src | no fix |
| Ubuntu Pro 16.04 LTS | qtsvg-opensource-src | no fix |
| Ubuntu Pro 18.04 LTS | qtsvg-opensource-src | no fix |
| Ubuntu Pro 20.04 LTS | qtsvg-opensource-src | no fix |
| Ubuntu Pro 22.04 LTS | qtsvg-opensource-src | no fix |