CVE-2026-8168 PUBLISHED

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

• Propagate QSvgExtraStates variables to pattern and mask elements
• Fix rendering causing stack overflow
• Fix resolving paint servers going through stack overflow
• Fix stack overflow caused by recursive calls of destructors
• Add a test for deeply nested SVG files
• Add baseline test for deeply nested elements
• Speed up QSvgStructureNode::releaseDescendants()
• Fix stack overflow in detectCycles
• Use bottom tested loop in detectCycles()
• Apply and revert styles iteratively
• Propagate QSvgExtraStates variables to pattern and mask elements

• CWE-674 Uncontrolled Recursion CWE

• CAPEC-230 Serialized Data with Nested Payloads