CVE-2026-19248: QDomDocument XML Parsing DOS Vulnerability

CVE-2026-19248 Overview

CVE-2026-19248 is a denial-of-service vulnerability in the Qt framework's QDomDocument XML parser. Untrusted XML input can trigger a remotely-exploitable crash in applications that parse documents using this component. The flaw is categorized under [CWE-674] Uncontrolled Recursion, indicating the parser fails to bound recursive processing when handling adversarial input structures. Any Qt-based application exposing QDomDocument to network-reachable XML data is at risk, including desktop clients, embedded systems, and services that ingest XML over HTTP or messaging protocols. The issue was published to NVD on September 16, 2026 and is being tracked upstream in the Qt Project.

Critical Impact
A single crafted XML document delivered to a Qt-based application can crash the process, disrupting availability for any workflow that depends on QDomDocument parsing.

Affected Products

Qt framework (qtbase) — QDomDocument XML parsing component
Downstream applications and services that use QDomDocument to parse untrusted XML
Embedded and desktop products built on affected Qt versions

Discovery Timeline

2026-09-16 - CVE-2026-19248 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19248

Vulnerability Analysis

The defect resides in the XML processing logic of QDomDocument, part of Qt's qtbase module. When the parser encounters a specially crafted XML document, it enters a code path that leads to an unrecoverable crash of the host process. The classification as [CWE-674] Uncontrolled Recursion indicates that structural elements in the input drive the parser into recursion that exceeds available stack resources. Because the exploit requires only a valid-looking XML payload, adversaries can trigger the crash without authentication. The attack requires the target application to open or otherwise parse the attacker-supplied document, satisfying the passive user-interaction requirement noted in the CVSS vector.

Root Cause

The root cause is unbounded recursive descent while parsing nested XML constructs in QDomDocument. The parser does not enforce a maximum recursion depth or convert the recursion into an iterative implementation. Adversaries exploit this by deeply nesting elements or entities in the payload, forcing repeated function invocations until the stack is exhausted. Technical details are tracked in the Qt Project Code Review.

Attack Vector

The attack vector is network-adjacent through any channel that feeds XML into a Qt application. Common delivery paths include XML documents downloaded over HTTP, attachments processed by desktop clients, configuration files fetched from remote sources, and messages carried by SOAP or XMPP services built on Qt. Exploitation does not require credentials. The result is a crash of the affected process, producing a denial-of-service condition for the user or service depending on that component.

No verified public exploit code is available. The vulnerability is described in prose based on the upstream code review referenced above; readers should consult the Qt Project change record for concrete parser behavior.

Detection Methods for CVE-2026-19248

Indicators of Compromise

Repeated abnormal terminations or SIGSEGV crashes of Qt-based processes shortly after receiving external XML input
Crash dumps whose backtraces show deep recursion inside QDomDocument or QDomNode parsing routines
Inbound XML payloads exhibiting excessive element nesting depth or recursive entity structures

Detection Strategies

Inspect application and system logs for correlated crash events tied to XML ingestion endpoints or file open operations
Deploy XML schema validation and depth limits at network gateways to flag documents that exceed reasonable nesting thresholds
Monitor endpoint telemetry for unexpected termination of Qt-based binaries following network activity from untrusted sources

Monitoring Recommendations

Enable core dump collection on servers running Qt-based XML processors and forward stack traces to a central analytics platform
Track process crash rates per host and alert on statistically significant increases affecting Qt applications
Correlate network flows carrying XML content-types with process lifecycle events to identify triggering payloads

How to Mitigate CVE-2026-19248

Immediate Actions Required

Inventory all deployed applications that link against Qt and use QDomDocument to parse external XML
Restrict exposure of Qt-based XML parsers to untrusted network sources until a patched Qt build is deployed
Apply upstream Qt fixes as soon as vendor releases become available for the affected qtbase versions

Patch Information

The fix is being landed through the upstream Qt change referenced in the Qt Project Code Review. Downstream distributions and application vendors will ship updated qtbase packages incorporating this change. Rebuild and redeploy any statically linked Qt applications after updating to a patched Qt release.

Workarounds

Pre-validate incoming XML against a strict schema and reject documents exceeding a bounded element nesting depth
Disable or gate external XML ingestion paths in affected applications until patched Qt builds are installed
Run Qt-based XML parsing in an isolated, restartable worker process so that a crash does not disrupt the parent service

bash

# Example: reject deeply nested XML at an ingestion proxy before it reaches QDomDocument
# Adjust the depth threshold to match legitimate document structures in your environment
xmllint --nonet --maxmem 10485760 --noout "$INPUT_FILE" \
  && awk 'BEGIN{d=0;max=0} { for(i=1;i<=length($0);i++){c=substr($0,i,1); if(c=="<"){d++; if(d>max)max=d} else if(c==">")d--} } END{ if(max>100) exit 1 }' "$INPUT_FILE" \
  || { echo "Rejected: excessive XML nesting depth"; exit 1; }