A denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) of the qtbase component has been discovered and has been assigned the CVE id CVE-2026-16762.

Affected versions: from Qt 4.3.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1. QtXml / QDomDocument is not affected by this issue.

Affected status unknown before Qt 4.3.0.

Impact: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed.…