CVE-2026-15037: XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15037?
The severity of CVE-2026-15037 is rated as risk 33.
How do I fix CVE-2026-15037?
To fix CVE-2026-15037, ensure you are using a version of Qt XML that is updated beyond version 6.11.
What applications are affected by CVE-2026-15037?
CVE-2026-15037 affects applications using Qt XML versions from 4.0.0 through 6.11.
What type of vulnerability is CVE-2026-15037?
CVE-2026-15037 is an XML injection vulnerability due to improper output neutralization.
How does CVE-2026-15037 affect Qt XML?
CVE-2026-15037 allows untrusted text to inject arbitrary XML markup through improperly serialized nodes.