Type Confusion and Heap-based Buffer Overflow vulnerability in the SVG marker and mask handling of the Qt SVG module has been discovered and has been assigned the CVE id CVE-2026-6210 .

Affected versions: from Qt 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.

Impact: Loading and rendering an svg image can lead to pointers (QSvgNode *) being cast down to pointers to the wrong derived classes (QSvgMarker *, QSvgMask *) which can lead to executing a code path which does not expect endless recursion and therefore does not guard against it. The result is an application crash (denial of service).

CVSS 4.0 Score : 8.7 (HIGH)

Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Mitigation: Ensure that all SVG content rendered by Qt SVG is only from trusted sources.…