PatchSiren

Qt Project CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Qt Project CVE published 2026-05-06

CVE-2026-6210

A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine [truncated]