CVE-2026-6210
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-122
Desbordamiento de búfer basado en memoria dinámica (Heap)
Fecha de publicación:
06/05/2026
Última modificación:
06/05/2026
Descripción
*** Pendiente de traducción *** A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.<br />
<br />
<br />
<br />
When processing SVG marker references, the renderer retrieves a node by its id attribute and casts it to QSvgMarker* without verifying the node type. A non-marker element (such as a element) that references itself as a marker triggers an out-of-bounds heap read due to the object size difference between QSvgLine and QSvgMarker,<br />
followed by an endless recursion that bypasses the marker recursion <br />
guard through incorrect virtual dispatch. The result is an application <br />
crash (denial of service).<br />
<br />
<br />
<br />
This issue affects Qt SVG: <br />
from 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA