---
id: CVE-2026-8168
title: >-
  qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements
  (CVE-2026-8168)
summary: >-
  A flaw was found in the Qt SVG module. A remote attacker could trigger this
  issue by providing a specially crafted SVG (Scalable Vector Graphics) file
  containing deeply nested elements. When parsed, this leads to uncontrolled
  recursion and…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
  - CWE-674
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
patched:
  - hardened_images
published: '2026-10-19'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T03:58:05+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-8168'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555573'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-8168'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8168'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730501'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730590'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730591'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/730892'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/731257'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/733245'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/738811'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/743488'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/748966'
  - url: 'https://codereview.qt-project.org/c/qt/qtsvg/+/756512'
  - url: >-
      https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:
  - url: 'https://access.redhat.com/errata/RHSA-2026:58460'
  - url: 'https://access.redhat.com/errata/RHSA-2026:80569'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00404
epssPercentile: 0.34514
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T14:27:04.849301Z'
scores:
  vendor: 6.5
  cna: 7.1
ingestedAt: '2026-10-19T13:28:55.891Z'
---

## Overview

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG (Scalable Vector Graphics) file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a Denial of Service (DoS).

## Vendor advisories

- **RHSA-2026:58460** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:58460)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8168.json)
- **RHSA-2026:80569** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:80569)

**qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements** — rated Moderate by Red Hat. Released 2026-10-19, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images

Fixed:

- Red Hat Hardened Images

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images

Not affected:

- Red Hat Hardened Images

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:58460

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.