CVE-2026-11573

An uncontrolled recursion flaw (CWE-674) in the serialization path of Qt's QtXml module lets a deeply nested, attacker-supplied XML document drive unbounded recursive calls that exhaust the process stack. Any application that embeds an affected Qt build and serializes untrusted XML through QDomDocument — e.g., when saving, converting, or re-emitting XML received from users, files, or network feeds — can be crashed by a crafted document with excessive nesting depth. The impact is denial of service only: the CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VA:H, no confidentiality or integrity impact) indicates the attacker gains availability loss, not code execution or data access. Affected parties are operators of Qt-based desktop and embedded applications that process untrusted XML with QDomDocument; the available data does not specify exact affected or fixed version ranges. There is no evidence of exploitation so far: no public proof of concept, not listed in CISA KEV, and EPSS puts the 30-day exploitation probability at only 0.3% (24th percentile).

What to do: Inventory applications and appliances that bundle Qt and use QDomDocument to serialize untrusted XML, then apply the patched Qt release referenced in the vendor advisory once identified (no fixed version was given in the available data). As an interim mitigation, validate and cap the nesting depth of untrusted XML, or route untrusted-input XML serialization through a hardened component. Given no public PoC and low EPSS, this is low-urgency, but re-check KEV/EPSS status before triage prioritization.