CVE-2026-19248CWE-674

CVE-2026-19248

published September 16, 2026

CVSS
7.1
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L
EPSS
0.00421 · 35.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-16T11:16Z
References (1)
https://codereview.qt-project.org/c/qt/qtbase/+/740427 · a59d8014-47c4-4630-ab43-e1b13cbe58e3
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 16 SEP 06:37Z
    Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
    cvelistv5