CVE-2026-15037

LOW

Qt XML 4.0.0-6.11 - QDom XML Injection

Title source: manual

Description

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

References (1)

Core 1

Core References

Patch patch

https://codereview.qt-project.org/c/qt/qtbase/+/748323

Scores

CVSS v4 2.9

EPSS 0.0026

EPSS Percentile 17.9%

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-91

Status published

Products (1)

Qt/Qt 4.0.0 - 6.12.0

Published Jul 23, 2026

Tracked Since Jul 23, 2026