CVE-2026-11573 in Qt
Summary
by MITRE • 09/08/2026
Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the app via stack exhaustion (DoS only).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified involves an uncontrolled recursive execution flaw within the Qt framework, specifically affecting the QDomDocument class found in the QtXml module. This component is responsible for parsing and serializing Extensible Markup Language documents into a Document Object Model tree structure. When processing XML data that contains deeply nested elements or structures with excessive indentation levels, the serialization routine fails to enforce appropriate depth limits or recursion guards. Consequently, each level of nesting triggers another function call within the same recursive chain without adequate termination conditions based on available system resources. This behavior allows an attacker who can supply untrusted input to induce a stack exhaustion condition by crafting XML payloads with artificially deep hierarchies that exceed the default thread stack size allocated by the operating system for the application process.
From a technical perspective, this flaw represents a classic case of insufficient validation regarding resource consumption during recursive operations. The underlying issue stems from the algorithmic design which prioritizes structural fidelity over safety constraints when traversing complex node trees. As the parser descends into deeper levels of the XML document, it allocates stack frames for each nested element to manage local variables and return addresses. Without a counter or threshold mechanism to halt processing after a certain depth is reached, the call stack grows linearly with the nesting level until it consumes all available memory space reserved for that thread. This results in a segmentation fault or an abrupt termination of the application process due to stack overflow errors generated by the operating system kernel when protecting against illegal memory access beyond the allocated stack boundary.
The operational impact of this vulnerability is strictly limited to denial of service scenarios, as indicated by the lack of code execution capabilities associated with pure stack exhaustion in this context. An attacker can exploit this weakness remotely or locally depending on where the vulnerable application accepts XML input from untrusted sources such as web services, file uploads, or network protocols. Successful exploitation leads to immediate crash of the affected process, causing service interruption for users relying on that specific functionality. While there is no direct compromise of data confidentiality or integrity through this vector alone, the resulting instability can disrupt business operations and potentially mask more sophisticated attacks if the application restarts automatically without proper logging or monitoring mechanisms in place.
This vulnerability aligns with Common Weakness Enumeration category CWE-675 which describes usage of algorithm that exhibits unintended side effects under specific conditions related to resource consumption. It also maps to MITRE ATT&CK technique T1499 known as Endpoint Denial of Service where attackers leverage system vulnerabilities to degrade availability rather than steal data or gain access. Mitigation strategies should focus on implementing strict depth limits during XML parsing and serialization processes within the Qt application codebase. Developers must validate input complexity before processing it through QDomDocument methods, ensuring that nested structures do not exceed predefined thresholds considered safe for stack usage. Additionally enabling compiler flags that detect recursion depth issues early in development cycles can help prevent such flaws from reaching production environments. Upgrading to newer versions of the Qt framework where this issue may have been addressed is also recommended as part of a comprehensive patch management strategy aimed at reducing attack surface exposure.