qt6: qt6: Denial of Service via crafted SVG in VectorImage (CVE-2026-105923)

Overview

A flaw was found in qt6. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the application. When the VectorImage component processes a specially crafted Scalable Vector Graphics (SVG) file, an integer calculation error triggers an invalid memory access (null-pointer dereference). To trigger this issue, an attacker must persuade a user or application to load the malicious SVG file.

Vendor advisories

• RHSA-2026:89193 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-25 · advisory
• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-25 · vex

qt6: qt6: Denial of Service via crafted SVG in VectorImage — rated Moderate by Red Hat. Released 2026-10-21, updated 2026-10-25.

Affected:

• Red Hat Enterprise Linux 10

Fixed:

• Red Hat Hardened Images

No fix planned:

• Red Hat Enterprise Linux 10

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:89193

Workarounds / mitigations:

• Avoid opening or rendering untrusted SVG files in applications utilizing Qt6 QML VectorImage components.

Operational controls:

1. Verify that automated pipelines and users only process vector graphics received from trusted, verified sources.
2. Where handling untrusted graphics is necessary, isolate Qt6-based applications within a sandbox or unprivileged container environment (such as bubblewrap or an isolated container) to confine potential application crashes.

Caveats: Operational sandboxin…