{"id":"CVE-2026-97845","aliases":[],"cve":{"records":[{"id":"CVE-2026-97845","source":"Qt","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T05:24:04.653Z","published":"2026-11-12T13:08:43.473Z","modified":"2026-11-12T13:08:43.473Z"}],"publishers":[{"name":"Qt","role":"CNA","organizationId":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","modified":"2026-11-12T13:08:43.473Z"}],"references":[{"url":"https://www.qt.io/security-advisories?search=CVE-2026-97845","tags":["vendor-advisory"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/771290","tags":["patch"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/774512","tags":["patch"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/774513","tags":["patch"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/774632","tags":["patch"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/760219","tags":["patch"],"source":"Qt"},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/760220","tags":["patch"],"source":"Qt"}],"weaknesses":[{"id":"CWE-674","description":"CWE-674 Uncontrolled Recursion","source":"Qt"}],"applicability":[],"prioritization":[]},"title":"Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt","titleSource":"Qt","descriptionSource":"Qt","description":"An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).","score":4.3,"severity":"medium","published":"2026-11-12T13:08:43.473Z","modified":"2026-11-12T13:08:43.473Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"qt","name":"qt","platforms":[],"versions":[{"version":"0","status":"unknown","lessThan":"5.0.0","versionType":"python"},{"version":"5.0.0","status":"affected","lessThan":"6.8.10","versionType":"python"},{"version":"6.9.0","status":"affected","lessThan":"6.11.3","versionType":"python"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*"],"source":"Qt","url":"https://www.cve.org/CVERecord?id=CVE-2026-97845"}],"remediation":[],"references":["https://www.qt.io/security-advisories?search=CVE-2026-97845","https://codereview.qt-project.org/c/qt/qt5compat/+/771290","https://codereview.qt-project.org/c/qt/qt5compat/+/774512","https://codereview.qt-project.org/c/qt/qt5compat/+/774513","https://codereview.qt-project.org/c/qt/qt5compat/+/774632","https://codereview.qt-project.org/c/qt/qt5compat/+/760219","https://codereview.qt-project.org/c/qt/qt5compat/+/760220"],"sources":[{"name":"CVE","id":"CVE-2026-97845","modified":"2026-11-12T13:08:43.473Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97845"}],"assessments":[{"source":"Qt","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/U:Green","score":4.3}],"sourceAffected":[],"observedAt":"2026-11-13T01:26:34.730Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:05:31.288Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T02:35:32.827Z","attemptedAt":"2026-11-13T02:35:32.827Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T02:35:32.548Z","attemptedAt":"2026-11-13T02:35:32.548Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T02:35:32.010Z","attemptedAt":"2026-11-13T02:35:32.010Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T02:35:32.218Z","attemptedAt":"2026-11-13T02:35:32.218Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124396","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124396","modified":"Nov 12, 2026, 1:08:43 PM","score":4.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/U:Green","checkedAt":"2026-11-13T02:35:32.010Z"},{"source":"GitHub Advisory Database","id":"GHSA-qm3v-vpq6-gc2v","url":"https://github.com/advisories/GHSA-qm3v-vpq6-gc2v","modified":"2026-11-12T15:32:02Z","checkedAt":"2026-11-13T02:35:32.548Z"},{"source":"NVD","id":"CVE-2026-97845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97845","modified":"2026-11-12T21:30:23.870","score":4.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Green","checkedAt":"2026-11-13T02:35:32.827Z"}],"aiSummary":{"text":"Qt 5.0.0 to 6.8.9 and 6.9.0 to 6.11.2 are affected by an uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing. The weakness is CWE-674 Uncontrolled Recursion. Local access is required.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T04:21:06.290Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97845"}]}}