CVE-2026-79616

Executive Summary

CVE-2026-79616 is an out-of-bounds read vulnerability (CWE-125) in Qt Quick's SVG path parsing components, specifically within Context2D.path and PathSvg.path. The flaw is triggered when the library processes untrusted SVG path strings, potentially leading to memory disclosure, application crashes, and denial-of-service conditions. No CVSS score, EPSS score, public proof-of-concept, or vendor patch is currently available, leaving affected Qt Quick deployments unmitigated against this parsing flaw.

Technical Analysis

The vulnerability resides in the SVG path string parsing logic used by Qt Quick's rendering pipeline. Specifically, the issue manifests in two related code paths: Context2D.path (the Canvas 2D API path interface exposed in QML) and PathSvg.path (the QML PathSvg element used within Path or Shape geometries). Both components accept SVG path data, which is a string format defined by the SVG specification for describing vector outlines (commands such as move, line, curve, arc, and close-path directives, along with coordinate parameters).

When an application passes an attacker-controlled SVG path string to either of these interfaces, the parser processes the tokenized commands and coordinate values. The out-of-bounds read occurs during this parsing phase. According to the NVD description, the flaw is specifically an out-of-bounds read — meaning the parser reads past the bounds of an allocated buffer while interpreting the path string. This class of defect typically arises when parsing logic mishandles malformed, truncated, or adversarially crafted command sequences, missing bounds checks on token length, coordinate counts, or array indexes.

Because this is CWE-125, the immediate consequence is information disclosure: adjacent memory contents may be read and potentially rendered, logged, transmitted, or otherwise exposed through the application behavior. Depending on the memory layout and the parsing routine's use of the out-of-bounds data, the application may also terminate abruptly, producing a denial-of-service condition. Whether the read can be escalated to code execution is not established by the available data and should not be assumed.

The attack surface is broad wherever Qt Quick consumes externally supplied SVG path data. This includes QML applications that feed user input — such as file uploads, chat messages, document renderers, or configuration payloads — into Canvas or PathSvg path properties. Since the parsing runs inside the Qt Quick application process, any flaw operates with that process's privileges. There is no network-listener requirement described; the vector is the ingestion of a malicious path string by an application built on the affected Qt Quick components.

No affected version range, fixed version, or patch commit is provided by the vendor or the CNA. Consequently, the precise introduction and remediation points cannot be stated. The absence of a CVE-assigned CVSS vector means severity cannot be quantified from authoritative subscores; qualitative impact is limited to memory-safety violation in a client-side rendering framework.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-79616, and no in-the-wild exploitation has been reported. The following attack chain is therefore inferred from the vulnerability class (out-of-bounds read during SVG path parsing) and the interfaces named in the NVD description.

1. Reconnaissance and target identification. An attacker identifies an application or service that uses Qt Quick and accepts or processes SVG path data supplied by an untrusted source. This could be a desktop application that opens or imports SVG-derived content, a document or media viewer, a kiosk or embedded UI, or any QML component that binds external input into Context2D.path or PathSvg.path. Where the application is network-accessible (for example, through a message, upload, or rendering service), the attacker may enumerate the interface; where it is a thick client, the attacker may need to deliver a crafted file or payload to the user.

2. Triggering the flaw. The attacker crafts an SVG path string designed to cause the parser to read beyond an allocated buffer. Because the exact triggering input is not disclosed, the practical approach is fuzzing the SVG path grammar: malformed or truncated command sequences, unexpected coordinate arity, unusual numeric formats, or other edge cases in the path-data tokenizer. The crafted string is then provided to the application through whatever channel feeds the Context2D.path or PathSvg.path property.

3. Execution and payload delivery. No code execution is claimed for this vulnerability. The payload is the malformed path string itself. When parsed, the out-of-bounds read is performed by the vulnerable component. Depending on application behavior, the result may be a crash, a hang, or the surfacing of memory contents adjacent to the path buffer.

4. Post-exploitation impact. The most likely outcomes are denial-of-service (process termination or unresponsiveness caused by a parser fault) and information disclosure (leakage of memory contents if the read data is exposed through the application). Any further impact — for example, chaining the memory disclosure with a second vulnerability — would depend on factors not established by the available intelligence. Attackers targeting high-value clients might use the crash primitive for disruptive effects or the disclosure primitive to support reconnaissance and bypass of memory protections, but neither is confirmed here.

Impact Assessment

Because no CVSS vector or score is available, impact must be assessed qualitatively. The confidentiality impact is the primary concern inherent to CWE-125: out-of-bounds reads can expose memory contents, which may include pointers, heap metadata, or fragments of sensitive application data. The integrity impact is likely limited, as a read alone does not modify memory. The availability impact is potentially significant: malformed input that causes an out-of-bounds read can produce an unhandled fault, terminating or destabilizing the Qt Quick process. This is particularly impactful for embedded, kiosk, automotive, or medical-device user interfaces built on Qt, where a crash translates into loss of the primary user-facing function.

The blast radius depends entirely on deployment context. A single-process desktop application exposes only that process's memory and availability. A framework shared by many applications (for example, an installed Qt runtime consumed by multiple products) widens the exposure across every downstream application that parses untrusted SVG path data. Because Qt is widely embedded in cross-platform software, the aggregate number of potentially affected products is large, though no specific affected versions are enumerated by the available data.

Business impact includes potential regulatory exposure if memory contents leaked by the flaw contain personal or confidential data, service disruption for availability-focused exploitation, and remediation cost across any fleet of applications bundling the affected Qt Quick components. Until a CVSS score and patch are published, security teams should treat the vulnerability as a medium-to-high priority memory-safety defect pending further vendor guidance, and should prioritize inventorying applications that ingest untrusted SVG path content.

Detection Guidance

Sigma Rule

title: Suspicious SVG Path Data Parsing in Qt Quick Applications
id: 8f3c2a14-9b7e-4d1a-9c3e-7a2f5e6d8b01
status: experimental
description: Detects crash or abnormal termination of Qt Quick-based applications correlating with malicious SVG path input, indicative of CVE-2026-79616 out-of-bounds read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79616
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: application
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '.exe'
    CommandLine|contains:
      - '.svg'
      - 'PathSvg'
      - 'Context2D'
  selection_fault:
    EventID:
      - 1000
      - 1001
  condition: selection_process and selection_fault
falsepositives:
  - Legitimate SVG rendering of complex but valid files
level: medium

YARA Rule

rule CVE_2026_79616_Qt_SVG_Path_OOB
{
    meta:
        description = "Detects SVG path strings with anomalous structure that may trigger the Qt Quick Context2D.path / PathSvg.path out-of-bounds read (CVE-2026-79616)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79616"
        severity = "medium"

    strings:
        $svg_open = "<svg" ascii nocase
        $path_cmd = "d=" ascii nocase
        $quotes = /["'][^"']{512,}["']/ ascii

    condition:
        $svg_open and $path_cmd and #quotes > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79616 Possible Qt Quick SVG Path Out-of-Bounds Read Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<svg"; nocase; content:"d="; nocase; pcre:"/([MmLlHhVvCcSsQqTtAaZz][^A-Za-z]{200,}){5,}/R"; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,2026-79616; sid:90079616; rev:1;)

Elastic Detection

process where process.name like "*.exe" and
  process.command_line like "*.svg*" and
  event.action == "process-crash"

Splunk SPL Query

index=application_logs (sourcetype=qt_app OR sourcetype=windows_eventlog)
(EventCode=1000 OR "out-of-bounds" OR "access violation" OR "segmentation fault")
| where match(_raw, "(?i)svg|PathSvg|Context2D")
| stats count by host, process_name, signature, EventCode
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="qt,cve-2026-79616,">
  <rule id="100916" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.type">application_crash</field>
    <match>PathSvg|Context2D|out-of-bounds|access violation</match>
    <description>CVE-2026-79616: Possible Qt Quick SVG path out-of-bounds read leading to application crash.</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no vendor patch exists, defensive measures must reduce exposure. Treat all externally supplied SVG path data as untrusted: validate and sanitize path strings before they reach Context2D.path or PathSvg.path, reject malformed or unexpectedly long path data, and enforce strict length and command-count limits at application trust boundaries. Where possible, disable or avoid Canvas 2D and PathSvg parsing of untrusted input entirely. Restrict which files or messages the application will render as SVG, and apply least-privilege process settings, OS hardening (ASLR, DEP), and sandboxing or application isolation to contain crashes and limit memory-disclosure impact. Monitor for abnormal application termination correlated with SVG input.

2. Patch/upgrade steps. No fixed version or vendor advisory is currently available. Security teams should track the Qt project's security advisories, the Qt Quick submodule release notes, and the upstream Qt Gerrit/commit history for a fix referencing Context2D.path or PathSvg.path parsing bounds. Once a patched Qt version is released, upgrade the Qt runtime and all affected applications, and verify the version used at build and runtime (statically linked components often lag behind). Maintain an inventory of which products bundle Qt Quick and at which version so remediation can be targeted immediately when a fix lands.

3. Long-term hardening. Adopt a fuzzing program targeting SVG path parsers in the organization's rendering stack, integrate memory-safety analysis (SAST, ASan) into CI for any code linking Qt Quick, and favor component isolation so that a parser flaw in one process cannot affect unrelated functionality. Establish a software bill of materials (SBOM) that lists Qt and its submodules to speed future impact analysis. For high-assurance deployments, consider memory-safe rendering alternatives or wrappers that sanitize path data before it reaches vulnerable interfaces.

References

• NVD — CVE-2026-79616: https://nvd.nist.gov/vuln/detail/CVE-2026-79616
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• Qt Project security advisories: https://www.qt.io/security
• CISA Known Exploited Vulnerabilities Catalog (not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog