Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Qt XML parser can be forced to use excessive memory

CVE-2013-4549 · published 12 years ago
Summary

The QXmlSimpleReader component in Qt versions before 5.2 can be tricked by specially crafted XML files to expand many entities, causing the program to consume large amounts of memory and potentially stop working. This affects applications that use Qt's XML parsing features. Upgrade to Qt 5.2 or later, or apply vendor patches, to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
digia qt <= 5.1.0
cpe:2.3:a:digia:qt:*:*:*:*:*:*:*:*
qt qt 5.0.2
cpe:2.3:a:qt:qt:5.0.2:*:*:*:*:*:*:*
Original advisory text
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published23 Dec 2013
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-4549 · NVD
Track software like this
Free during beta