CVE-2026-78253

Executive Summary

CVE-2026-78253 is an uncontrolled recursion vulnerability (CWE-674) in QXmlStreamReader::readElementText() within the Qt framework, caused by insufficient depth control when parsing attacker-supplied XML documents. A crafted XML document containing deeply nested elements drives recursive descent until the process exhausts its stack, resulting in an application crash (denial of service). Any application, service, or daemon that uses Qt's XML stream parsing on untrusted input — including desktop clients, embedded/industrial HMI software, network services, and backend processors built on Qt — is potentially affected. No CVSS score, EPSS score, affected version range, or patch has been published by the vendor or NVD at the time of writing, and no public proof-of-concept or exploit code exists in tracked sources.

Technical Analysis

The vulnerability resides in Qt's stream-based XML reader, QXmlStreamReader, and specifically in the readElementText() member function. QXmlStreamReader is a pull parser: the consumer repeatedly calls read primitives to advance through the token stream. readElementText() is the convenience API that, given the reader is positioned on a start element, consumes all content up to and including the matching end element and returns the concatenated character data.

Where the parsing logic that services readElementText() walks nested element content, the element handling is implemented with recursion — each nested start element descends one level deeper. The depth of this descent is derived from the input document's element nesting depth. If the parser imposes no effective maximum on nesting depth, or if the check is bypassable, a document with sufficiently deep nesting causes unbounded recursion. Each frame consumes stack space; once the stack limit is reached, the process faults (stack exhaustion/overflow) and terminates. The NVD description states exactly this outcome: denial of service via application crash through stack exhaustion.

Two properties of this class make it operationally significant:

• Input-controlled depth. The recursion depth is not bounded by the API caller but by the XML document supplied at runtime. An attacker therefore controls resource consumption precisely by choosing nesting depth — a single parameter in the payload.
• Crash, not corruption. The described impact is a crash via stack exhaustion. There is no stated memory-corruption or code-execution primitive in the NVD description, so this should be treated as an availability (denial of service) issue rather than a disclosure or RCE issue. Absent further technical detail, no claim about write-what-where behavior, heap grooming, or control-flow hijack is warranted.

The attack surface is any Qt code path that feeds untrusted XML to QXmlStreamReader and relies on readElementText(). Qt is a cross-platform application framework used broadly in C++ desktop applications, embedded systems (including automotive, medical, and industrial UIs), and network-facing services. Because the vulnerable component is a library routine rather than a standalone network service, exposure depends entirely on how the consuming application exposes XML ingestion: file import, configuration load, IPC/socket message, SOAP/REST body, or compressed archive member.

No specific mitigation code, depth-limit constant, or patched function signature is provided in the available sources. The precise location and nature of the fix are unknown, and no affected version range has been published. Analysts should not infer a specific Qt release as vulnerable or fixed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-674, uncontrolled recursion) and the NVD description, and uses only the identifiers named there (QXmlStreamReader::readElementText()).

1. Reconnaissance / target identification. The attacker identifies an application, service, or device that accepts XML input and is built on Qt. Because Qt is a library, fingerprinting occurs at the application layer: endpoints or file-import features that accept XML, Qt-linked binaries, or Qt-derived product banners. Common high-value targets are embedded/industrial HMIs, desktop document/config importers, and any daemon that parses XML messages from a network socket or queue.

2. Trigger of the flaw class. The attacker crafts an XML document with deeply nested elements — each level adding one more recursive descent into the readElementText() code path when the application parses the document. The nesting depth is chosen to exceed the process's available stack. A modest file size can carry very deep nesting because each level adds only a start/end tag pair, so the payload is small and bandwidth-cheap (classic asymmetric DoS).

3. Delivery / execution method. At the vulnerability-class level, the malicious document is delivered wherever the application ingests XML: uploaded/imported file, HTTP request body, socket message, or config drop. When the Qt parser reaches the nesting depth, recursion exhausts the stack and the process aborts. For network-facing services, an unauthenticated request may be sufficient if the XML parser is reached pre-authentication; for file-import features, delivery is via file upload or share.

4. Post-exploitation impact. The impact described by NVD is availability loss: application crash. On a service, crash may cause request failures or a supervised restart loop that an attacker can sustain by re-sending the payload; on an embedded device, a crash can halt the UI or the control process until watchdog/manual restart. No confidentiality or integrity impact, and no code execution, is described.

Impact Assessment

The impact scoped by the CVE is denial of service: application crash caused by stack exhaustion when parsing a crafted XML document. With no CVSS score published (NVD reports N/A), no NVD-derived metric breakdown exists to cite; the description supports an availability-focused impact profile, but a numeric score must not be asserted. EPSS has not been scored by FIRST.org, so no probability figure is quoted here.

Business impact is context-dependent and driven by where Qt XML parsing sits in the affected product: a desktop crash is a local annoyance; a crash in an embedded or industrial control UI can interrupt a monitored process or operator interface; a crash in a network-facing Qt service can cause sustained unavailability if the attacker retriggers it. Blast radius follows deployment of the affected library across all Qt-linked products and devices in the environment — potentially large in organisations with many Qt-based endpoint applications or embedded appliances. CISA KEV does not list this CVE, so there is no evidence of active exploitation tracked by that source. There is no public exploit code or Nuclei template to accelerate weaponisation; however, the vulnerability class is trivial to reproduce, so the absence of public tooling should not be taken as durable protection.

Detection Guidance

Detection must target two planes: (a) application/host events — crash signature and exception, and (b) input/network artefacts — XML payloads with anomalous nesting depth arriving at ingestion points.

Sigma Rule

title: Potential Qt QXmlStreamReader Stack Exhaustion Denial of Service
id: 8f5f9c8e-7a2d-4a0e-9b1a-2c3d4e5f6a7b
status: experimental
description: Detects process crashes consistent with stack exhaustion while parsing deeply nested XML, indicating possible exploitation of CVE-2026-78253 (QXmlStreamReader::readElementText uncontrolled recursion).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78253
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: windows
detection:
  selection_crash:
    EventID: 1000
    Message|contains:
      - 'stack overflow'
      - 'stack exhaustion'
      - 'STATUS_STACK_OVERFLOW'
      - '0xC00000FD'
  selection_xml_context:
    Message|contains:
      - 'Qt'
      - 'QXmlStreamReader'
      - 'readElementText'
  condition: selection_crash and selection_xml_context
falsepositives:
  - Legitimate deeply nested configuration files
  - Application bugs unrelated to untrusted input
level: medium

YARA Rule

rule CVE_2026_78253_Qt_QXmlStreamReader_DeepNesting_DoS
{
    meta:
        author = "valtersit.com"
        description = "Detects XML documents with pathological element nesting that may trigger uncontrolled recursion in QXmlStreamReader::readElementText() (CVE-2026-78253)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78253"
        cve = "CVE-2026-78253"
        date = "2026-01-01"

    strings:
        $xml1 = "<?xml"
        $xml2 = "<"

    condition:
        // XML document whose total length is dominated by repeated open/close tags,
        // indicating very deep nesting rather than large content.
        filesize < 5MB and
        $xml1 at 0 and
        #xml2 > 2000
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78253 Possible Qt QXmlStreamReader Deep-Nesting XML DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<"; depth:1; pcre:"/(?:<[A-Za-z0-9_:.-]+>){500,}/R"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-78253; sid:90078253; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("*.exe", "*.bin") and
  process.args : "*xml*"

Complementary EQL for crash/abort signal followed by rapid process restart pattern:

sequence by host.id, process.entity_id with maxspan=30s
  [ process where event.type == "start" and process.name : "*" ]
  [ process where event.type == "end" and
      (process.exit_code == 134 or process.exit_code == -1073741571) ]

Splunk SPL Query

index=* (EventCode=1000 OR EventCode=1001 OR source="/var/log/syslog" OR source="/var/log/messages")
(Message="*stack overflow*" OR Message="*stack exhaustion*" OR Message="*STATUS_STACK_OVERFLOW*" OR Message="*SIGSEGV*" OR Message="*Segmentation fault*")
(Message="*Qt*" OR Message="*QXmlStreamReader*" OR Message="*readElementText*" OR Message="*xml*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, Message
| where count >= 2
| sort - count

Wazuh OSSEC Rule

<group name="qt,xml,dos,">
  <rule id="100782" level="10">
    <decoded_as>syslog</decoded_as>
    <match>CVE-2026-78253|QXmlStreamReader|readElementText|stack exhaustion</match>
    <description>Possible exploitation of CVE-2026-78253 (Qt QXmlStreamReader uncontrolled recursion / stack exhaustion DoS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100783" level="12">
    <if_sid>100782</if_sid>
    <match>SIGSEGV|Segmentation fault|stack overflow</match>
    <description>CVE-2026-78253 follow-on: application crash consistent with XML parser stack exhaustion</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, version range, or patch advisory is available in the supplied data. The following are risk-reduction measures; a definitive vendor patch is required and should be tracked via the Qt security advisory channel when published.

1. Immediate mitigations

   • Do not feed untrusted XML into Qt's QXmlStreamReader-based parsing. Enforce strict input allow-listing at every ingestion point (file import, network payload, IPC/queue message).
   • Impose a pre-parse depth and size limit on XML in the consuming application: reject documents whose maximum element nesting depth exceeds a low, business-justified threshold before they reach the Qt parser.
   • Where XML is only one of several accepted formats, disable or restrict the XML import path for untrusted sources.
   • Isolate XML-processing components (containers, sandboxing, least-privilege service accounts) and configure process supervision/watchdogs so a crash degrades safely instead of cascading.
   • For network-facing services, apply rate limiting and body-size limits at the reverse proxy/WAF to blunt repeated re-triggering.

2. Patch / upgrade steps

   • Monitor the Qt project security advisories and NVD entry for CVE-2026-78253 for a patched release. No version range is currently published; do not assume any specific Qt release is fixed or affected.
   • Once a fix is available, inventory all Qt-linked binaries and rebuild/redeploy them against the corrected Qt library; static linking means each consuming product must be re-released.

3. Long-term hardening

   • Adopt a managed XML parsing policy: dedicated hardened parsers for untrusted input, mandatory nesting-depth and entity-expansion limits, and fuzzing of XML ingestion paths (readElementText() included).
   • Maintain an SBOM covering third-party frameworks such as Qt so affected components can be located quickly.
   • Add CI fuzzing (deep-nesting and malformed-XML corpora) to applications that consume XML.
   • Keep resilience engineering in place (health checks, automatic restart, alerting on repeated crash loops) so a denial-of-service fault does not become an outage.

References

• NVD — CVE-2026-78253: https://nvd.nist.gov/vuln/detail/CVE-2026-78253
• CWE-674 — Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Qt Project security advisories (vendor channel; no CVE-specific advisory available at publication): https://www.qt.io/
• FIRST.org EPSS (CVE not yet scored at time of writing): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild: none reported. CVE-2026-78253 is not listed in CISA KEV, and no public PoC, exploit code, or Nuclei template was identified in tracked sources. All exploitation guidance above is inferred from the vulnerability class and NVD description only.