{"id":"CVE-2026-8168","title":"qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements (CVE-2026-8168)","summary":"A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG (Scalable Vector Graphics) file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-674"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","hardened_images"],"patched":["hardened_images"],"published":"2026-10-19","updated":"2026-10-23","sourceUpdated":"2026-10-23T03:58:05+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-8168"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555573"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8168"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8168"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/730501"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/730590"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/730591"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/730892"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/731257"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/733245"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/738811"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/743488"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/748966"},{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/756512"},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:"},{"url":"https://access.redhat.com/errata/RHSA-2026:58460"},{"url":"https://access.redhat.com/errata/RHSA-2026:80569"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00404,"epssPercentile":0.34514,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T14:27:04.849301Z"},"scores":{"vendor":6.5,"cna":7.1},"ingestedAt":"2026-10-19T13:28:55.891Z","slug":"CVE-2026-8168","body":"## Overview\n\nA flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG (Scalable Vector Graphics) file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:58460** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:58460)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json)\n- **RHSA-2026:80569** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80569)\n\n**qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements** — rated Moderate by Red Hat. Released 2026-10-19, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:58460\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225679,"id":"CVE-2026-8168","ts":1792498353801,"field":"cvss","old":"7.1","new":"6.5"},{"seq":225678,"id":"CVE-2026-8168","ts":1792498353801,"field":"severity","old":"high","new":"medium"}]}