Skip to main content

Security advisory: CVE-2026-79616 Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick

Sep 23, 2026

by Tero Pelkonen
Comments

Out-of-bounds read vulnerability in the Qt Quick Context2D.path and PathSvg.path properties of the QQuickSvgParser component has been discovered and has been assigned the CVE id CVE-2026-79616. 

Affected versions: from Qt 5.10 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.1. 
 
Impact: Out-of-bounds memory read while parsing the path string in a Qt Quick element's Context2D.path or PathSvg.path property may lead to a segmentation fault, a parse failure, or garbage being rendered. The input string used with Context2D.path is typically application controlled, but it might be sourced from anything that string data can be read from, including remote files. The issue only represents a vulnerability for applications that don't control the value assigned to Context2D.path. 
 
CVSS 4.0 Score: 0.6 / Low 
 
Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green
 
Mitigation: Don't feed path strings from untrusted sources into the Context2D.path or PathSvg.path properties. This is generally the guidance with QML code. 
 
Solution: Apply the following patch or update to Qt 6.8.9, Qt 6.11.2 or later. 
 

 

 

Blog Topics

Comments

Comments are disabled for this post.

Subscribe to our blog

Try Qt 6.12 Now!

Download the latest release here: www.qt.io/download

Qt 6.12 LTS is now available, with new features and improvements for application developers and device creators.

We're Hiring

Check out all our open positions here and follow us on Instagram to see what it's like to be #QtPeople.

Related Articles

Security advisory: CVE-2026-95620 Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt

Security advisory: CVE-2026-95620 Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt

A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2..

Read Article
Security advisory: CVE-2026-16762 Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

Security advisory: CVE-2026-16762 Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

A denial-of-service vulnerability in the Qt Core QXmlStream parser..

Read Article
Security advisory: CVE-2026-96432 - Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

Security advisory: CVE-2026-96432 - Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt

A null pointer dereference vulnerability in the Qt QNetworkAccessManager..

Read Article