CVE-2015-9541

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-24 · updated 2026-06-17
Weakness: CWE-776

Description

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

Affected products

Fedoraproject Fedora: 31, 32
Qt: from 5.5.0 before 5.12.8 — fixed in 5.12.8

How to fix

Upgrade to a fixed version: Qt 5.12.8. Check the vendor advisory for mitigations.

References

https://bugreports.qt.io/browse/QTBUG-47417
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PT6327C64Q4RBFRWUSBKCG7SVGBWU5W/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZMMF4OEJAZRVKVXNO7IZWLEZVQGJN6G/
https://bugreports.qt.io/browse/QTBUG-47417
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PT6327C64Q4RBFRWUSBKCG7SVGBWU5W/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZMMF4OEJAZRVKVXNO7IZWLEZVQGJN6G/

Get alerted when CVE-2015-9541 or the next vulnerability affects your stack