CVE-2026-11573 qt CVE debrief

Who should care

Defenders and developers using the Qt XML module (QtXml, qtbase) in their applications should assess exposure and prioritize mitigation. This includes reviewing XML parsing and serialization code, validating input documents, and applying patches or updates as available.

Why it matters

CVE-2026-11573 is a high-severity denial-of-service vulnerability in the Qt XML module. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems using Qt XML module for parsing or serializing XML documents. The vulnerability allows for potential denial-of-service due to process termination when serializing deeply nested XML documents. There is no code execution or memory disclosure. Verification of affected versions, application of patches, and implementation of input validation are crucial.

• Potential denial-of-service due to process termination.
• Need for input validation and document depth checks.
• Possible performance impact due to excessive recursion.
• Verification of Qt XML module version and patch level required.

Technical summary

The Qt XML module (QtXml, qtbase) is vulnerable to a denial-of-service attack due to uncontrolled recursion in the QDomDocument/QDomNode serialization path. Specifically, QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually without a depth limit, consuming one stack frame per level of element nesting. This can cause a process to terminate when serializing deeply nested XML documents.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems using Qt XML module for parsing or serializing XML documents.

Recommended defensive actions

• Verify and apply patches or updates for Qt XML module (QtXml, qtbase) as available.
• Implement input validation and document depth checks for XML documents to prevent excessive recursion.
• Monitor systems using Qt XML module for abnormal termination or crashes.
• Consider using alternative XML parsing libraries with built-in recursion limits.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by uncontrolled recursion in QDomElementPrivate::save() and QDomNodePrivate::save() with no depth limit or error return. This can be reached via several functions including QDomDocument::toByteArray(), QDomDocument::toString(), and QDomNode::save().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.