PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-19248 qt CVE debrief

CVE-2026-19248 is a denial-of-service vulnerability in QDomDocument XML parsing. Defenders should assess exposure, prioritize verification, and monitor for potential crashes. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. However, the CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine affected systems and potential impact. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The vulnerability class is related to XML parsing, and the likely operational impact is a denial-of-service crash. Source-confidence limits,

Vendor
qt
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-09-18
Advisory published
2026-09-16
Advisory updated
2026-09-18

Who should care

Defenders responsible for systems using QDomDocument XML parsing should assess exposure and prioritize verification. Affected operators, platforms, vulnerability-management, and security teams should be aware of the vulnerability and its potential impact. They should review vendor-provided information for affected versions and remediation guidance, and plan vendor-supported updates or mitigations through normal

Why it matters

CVE-2026-19248 is a denial-of-service vulnerability in QDomDocument XML parsing. Defenders should assess exposure, prioritize verification, and monitor for potential crashes. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. However, the CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine affected systems and potential impact.

  • Potential system crashes due to denial-of-service vulnerability.
  • Need for verification of affected systems and exposure to untrusted input.
  • Possible impact on system availability and reliability.

Technical summary

CVE-2026-19248 is a remotely-triggerable denial-of-service crash in QDomDocument XML parsing when processing untrusted input. The vulnerability affects systems using QDomDocument XML parsing and has a CVSS score of 7.1. Defenders should prioritize verification of affected systems and monitor for potential crashes. The technical impact is a denial-of-service crash, and the defensive impact is the need for verification of affected systems and exposure to untrusted input.

Defensive priority

Defenders should prioritize verification of affected systems and monitor for potential crashes.

Recommended defensive actions

  • Verify if systems using QDomDocument XML parsing are exposed to untrusted input.
  • Monitor systems for potential crashes.
  • Review vendor-provided information for affected versions and remediation guidance.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine affected systems and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-19248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-19248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-19248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-19248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://codereview.qt-project.org/c/qt/qtbase/+/740427

    a59d8014-47c4-4630-ab43-e1b13cbe58e3

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.