{
  "cveId": "CVE-2026-16762",
  "url": "https://patchblox.com/security/cve/CVE-2026-16762",
  "summary": "CVE-2026-16762 is fixed in qt6-base on 1 platform by DEBIAN-CVE-2026-16762 (version 6.11.2\u002Bdfsg-5), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt",
  "description": "An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity \u2014 no data disclosure, data modification, or code execution \u2014 and the impact is contained to the affected process.",
  "published": "2026-10-23T09:17:06Z",
  "severity": "Moderate",
  "cwe": "Inefficient Algorithmic Complexity",
  "epss": 0.00516,
  "epssPercentile": 0.44205,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-16762",
  "fixes": [
    {
      "platform": "linux",
      "product": "qt6-base",
      "release": "Debian 14",
      "fixedVersion": "6.11.2\u002Bdfsg-5",
      "fix": "DEBIAN-CVE-2026-16762",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-16762",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}