CVE-2026-6210: Qt SVG Type Confusion DoS Vulnerability

CVE-2026-6210 Overview

CVE-2026-6210 is a type confusion vulnerability [CWE-122] in the Qt SVG module. The flaw lets a remote attacker crash any application that renders attacker-controlled Scalable Vector Graphics (SVG) content. Exploitation requires no authentication and no user interaction beyond opening or rendering the malicious image.

The Qt SVG renderer resolves marker references by node id and casts the result to QSvgMarker* without validating the node type. A non-marker element such as <line> that references itself as a marker triggers an out-of-bounds heap read followed by unbounded recursion, crashing the process.

Critical Impact

Remote, unauthenticated attackers can crash any Qt-based application that processes untrusted SVG input, producing a denial of service condition across desktop, embedded, and mobile Qt deployments.

Affected Products

• Qt SVG versions 6.7.0 through 6.8.7
• Qt SVG versions 6.9.0 through 6.11.0
• Any application or framework that links against a vulnerable Qt SVG library and renders untrusted SVG content

Discovery Timeline

• 2026-05-06 - CVE-2026-6210 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-6210

Vulnerability Analysis

The vulnerability resides in the Qt SVG marker resolution path. When the renderer encounters a marker-start, marker-mid, or marker-end reference, it looks up the target node by its id attribute. The lookup returns a generic SVG node pointer, which the code then casts directly to QSvgMarker* without performing a runtime type check.

When an attacker crafts an SVG where a non-marker element references itself as its own marker, two distinct memory safety failures occur. First, the cast treats a smaller QSvgLine (or similar) object as the larger QSvgMarker object, producing a heap-based out-of-bounds read [CWE-122] across the trailing fields. Second, the marker recursion guard relies on virtual dispatch that is rerouted through the wrong vtable, defeating the cycle protection and causing unbounded recursive calls. The combination terminates the process through stack exhaustion or invalid memory access.

Root Cause

The root cause is missing type verification before downcasting. The renderer assumes that any node referenced as a marker is a QSvgMarker, with no dynamic_cast or explicit type tag check. A self-referential marker bypasses the recursion guard because the guard is implemented on QSvgMarker semantics that the confused object does not honor.

Attack Vector

An attacker delivers a crafted SVG file through any channel the target application accepts: a web page, an email attachment, a chat message, a file preview, or a network-loaded resource. When Qt SVG parses and renders the file, the type confusion fires immediately. No privileges and no user interaction beyond rendering are required.

The vulnerability impacts confidentiality only minimally because the out-of-bounds read result is consumed internally before the crash. The primary outcome is denial of service of the rendering process. See the Qt Project Code Review and OSS-Fuzz Issue Report for the upstream fix and reproducer.

Detection Methods for CVE-2026-6210

Indicators of Compromise

• SVG files containing a <line>, <path>, <rect>, or other non-marker element with marker-start, marker-mid, or marker-end attributes pointing to the element's own id
• Repeated unexpected crashes of Qt-based applications immediately after opening or previewing SVG content
• Crash dumps showing recursive frames inside Qt SVG marker rendering routines or access violations referencing QSvgMarker virtual calls

Detection Strategies

• Inspect inbound SVG attachments and downloads for self-referential marker-* attributes and cyclic id references using a content-aware proxy or mail gateway
• Enable application crash reporting and aggregate crashes by faulting module to surface anomalous Qt SVG failure clusters
• Inventory installed Qt versions across endpoints and servers, flagging any QtSvg library in the affected version ranges

Monitoring Recommendations

• Monitor Windows Error Reporting, macOS ReportCrash, and Linux coredumpctl output for repeated faults inside libQt6Svg or Qt5Svg
• Alert on processes that load Qt SVG libraries and terminate abnormally within seconds of receiving network or file input
• Track SVG rendering activity in browsers, document viewers, and chat clients that embed Qt for sudden spikes in crash telemetry

How to Mitigate CVE-2026-6210

Immediate Actions Required

• Upgrade Qt SVG to version 6.8.8 or later on the 6.8 branch, or 6.11.1 or later on the 6.11 branch
• Identify all internally developed and third-party applications that bundle Qt SVG and rebuild or repackage them against the patched library
• Restrict SVG rendering in high-risk applications until patches are deployed, especially for content sourced from untrusted networks or users

Patch Information

The Qt project addressed the issue by adding proper type verification before the QSvgMarker cast and hardening the marker recursion guard. The upstream fix is documented in the Qt Project Code Review. Distributions and downstream Qt-based products should pull the fix from the 6.8.8 and 6.11.1 release tags.

Workarounds

• Disable or strip SVG rendering in applications that do not require it, falling back to raster image formats for untrusted content
• Sanitize inbound SVG by removing marker-start, marker-mid, and marker-end attributes, or by rejecting SVGs whose marker references resolve to non-<marker> elements
• Sandbox the rendering process so that a crash is contained and cannot impact host stability or other workloads

# Configuration example: verify installed Qt SVG version on Linux
dpkg -l | grep -Ei 'libqt[56]svg'
rpm -qa | grep -Ei 'qt[56]-qtsvg'

# Strip vulnerable marker attributes from SVGs before rendering
sed -i -E 's/ marker-(start|mid|end)="[^"]*"//g' untrusted.svg