This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-15037 →
DEBIAN-CVE-2026-15037
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allo...
Original description
The description as published by the source.
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
qt6-base
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
qt6-base
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
qt6-base
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:12
qtbase-opensource-src
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
qtbase-opensource-src
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
qtbase-opensource-src
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- advisory security-tracker.debian.org