Qt CVE-2026-19248 is a High-severity denial-of-service vulnerability in Qt’s XML QDom handling. The key question is not simply whether an application uses Qt: exposure depends on both the Qt version and whether attacker-controlled or otherwise untrusted XML can reach the affected QDom parsing path.
Direct answer: Qt identifies versions from 2.2.0 through 6.8.8 and from 6.9.0 through 6.11.1 as affected. Applications using QDom classes to parse untrusted or externally supplied XML can crash because deeply nested XML may trigger unbounded destructor recursion. Qt directs users toward fixed releases or branch-specific patches.
Which Qt versions are affected?
Qt’s security advisory lists Qt 2.2.0 through 6.8.8 and Qt 6.9.0 through 6.11.1 as affected. The vendor rates the vulnerability CVSS 4.0 7.1 High.
This does not mean every application built with those Qt versions is automatically exposed. The relevant path involves QDom-based XML processing, such as applications using QDomDocument or related QDom classes, where untrusted or externally supplied XML can reach the parser.
What can CVE-2026-19248 do?
A specially constructed, deeply nested XML document can cause unbounded recursion while QDom nodes are destroyed. That can exhaust the process stack and crash the application, producing a denial-of-service condition.
Remote triggering is possible where an application accepts XML from an untrusted network source and feeds it into the affected QDom path. The reviewed Qt advisory does not establish remote code execution, data theft, authentication bypass or administrator compromise from this vulnerability.
Which fix applies to your Qt branch?
Qt 6.11
If the application is on an affected Qt 6.11 release, update to Qt 6.11.2 or later.
Qt 6.10
Qt directs users remaining on the closed Qt 6.10 branch to apply the vendor’s CVE-2026-19248 patch. Do not assume an existing 6.10 point release is fixed unless the CVE-specific patch is included.
Qt 6.8
Qt identifies 6.8.9 as the fixed release target. If 6.8.9 is not yet available through the application’s supported release channel, use Qt’s applicable 6.8 security patch or supported maintenance route instead of treating 6.8.8 as remediated.
Older affected Qt versions
The advisory’s affected range extends back to Qt 2.2.0. Older deployments should follow the applicable Qt support, Extended Security Maintenance, vendor patch or upgrade path rather than assuming a modern Qt 6 patch can be applied directly.
How to determine whether your application is actually exposed
Start by checking the Qt version shipped in the deployed application, not only the development environment. Then determine whether the application uses QDom classes for XML processing and whether external users, network services, uploaded files or other untrusted sources can supply XML that reaches that code path.
If the application never processes untrusted XML through QDom, the practical exposure may be lower even when the Qt version falls inside the vendor’s affected range. If attacker-controlled XML can reach QDom parsing, the remediation should be treated as an application-availability issue that requires a fixed release or applicable patch.
What if an immediate upgrade is difficult?
Qt’s advisory lists alternatives that can reduce exposure, including moving away from QDomDocument to streaming XML APIs, constraining XML nesting depth, increasing available stack space or using a build configuration that reduces per-frame stack use. These are mitigation options, not a reason to ignore the vendor’s fixed-version or patch guidance.
How to verify remediation
Confirm the production application has actually been rebuilt or redeployed with the applicable fixed Qt release or vendor patch. Version verification should cover the binaries and runtime components that users are executing, rather than only the package version recorded in a build system.
Where the application accepts external XML, verify that the deployed parser path now uses the remediated Qt code or an approved alternative parsing path. If the application remains on an older supported branch, retain evidence showing which Qt security patch or maintenance release contains the CVE-2026-19248 fix.
Is CVE-2026-19248 being actively exploited?
The reviewed evidence establishes the vulnerability and remediation guidance, but it does not establish known active exploitation or inclusion in CISA’s Known Exploited Vulnerabilities catalog. Do not treat the existence of an affected version as evidence that a specific application has been attacked.
Verification note
TPS reviewed the Qt security advisory, Qt-hosted release and patch information, and current branch guidance to reconcile the affected-version ranges with the available remediation paths. The remaining uncertainty is primarily downstream: individual products may package Qt differently, and real-world exposure depends on whether untrusted XML reaches the affected QDom code.
