Hi,

The following vulnerability was published for qtdeclarative-opensource-src.

CVE-2026-79616[0]:
| Out-of-bounds read while parsing untrusted SVG path strings in Qt
| Quick's Context2D.path / PathSvg.path.

This was fixed for qt6-declarative in
https://github.com/qt/qtdeclarative/commit/34a90737c73d5fb9043367fdf944a553f82f9053 (v6.11.2)
(https://codereview.qt-project.org/c/qt/qtdeclarative/+/754718 in Gerrit)
and appears to also affect qtdeclarative-opensource-src


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-79616
https://www.cve.org/CVERecord?id=CVE-2026-79616

Please adjust the affected versions in the BTS as needed.