Skip to main content

Qt CVE-2025-5683

| EUVDEUVD-2025-16968 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2025-06-05 a59d8014-47c4-4630-ab43-e1b13cbe58e3
Denial Of Service Qt
5.1
CVSS 4.0 · Vendor: a59d8014-47c4-4630-ab43-e1b13cbe58e3
Share

Severity by source

Vendor (a59d8014-47c4-4630-ab43-e1b13cbe58e3) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-delivered crafted file requires user or application interaction (UI:R); crash-only impact with no confidentiality or integrity loss limits to A:L, S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Ubuntu
MEDIUM
qualitative
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (a59d8014-47c4-4630-ab43-e1b13cbe58e3).

CVSS VectorVendor: a59d8014-47c4-4630-ab43-e1b13cbe58e3

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

6
CVSS changed
Jul 29, 2026 - 09:22 NVD
5.5 (MEDIUM) 5.1 (MEDIUM)
EUVD ID Assigned
Mar 14, 2026 - 17:53 euvd
EUVD-2025-16968
Analysis Generated
Mar 14, 2026 - 17:53 vuln.today
Patch released
Mar 14, 2026 - 17:53 nvd
Patch available
CVE Published
Jun 05, 2025 - 06:15 cve.org
MEDIUM 5.1
CVE Published
Jun 05, 2025 - 06:15 nvd
MEDIUM 5.5

DescriptionCVE.org

When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.

AnalysisAI

QImage's ICNS format parser in Qt crashes when loading a specifically crafted Apple Icon Image (ICNS) file, resulting in a denial-of-service condition affecting any application that processes ICNS images. The vulnerability spans three Qt release branches - 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0 - making it broadly applicable across the Qt ecosystem. No active exploitation has been identified (EPSS 0.04%, 13th percentile; not in CISA KEV), but the wide version range and Qt's prevalence in cross-platform desktop and embedded applications give it meaningful exposure.

Technical ContextAI

Qt's QImage class supports loading multiple image formats including ICNS via the qtimageformats plugin module. ICNS is Apple's multi-resolution icon container format, encoding several image representations at varying sizes and color depths within a single file. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the ICNS parser does not enforce bounds on resource allocation when processing crafted image metadata or pixel data, allowing a malformed file to trigger uncontrolled consumption leading to a process crash. The flaw was discovered through OSS-Fuzz automated fuzzing (issue 415350704), and the upstream fix was applied to the qtimageformats submodule (codereview.qt-project.org/c/qt/qtimageformats/+/644548). Affected products are identified under CPE cpe:2.3:a:qt:qt across all three version ranges.

RemediationAI

The primary fix is to upgrade Qt to version 6.5.10, 6.8.5, or 6.9.1, matching the installed branch. The underlying code change is in the qtimageformats submodule, available at https://codereview.qt-project.org/c/qt/qtimageformats/+/644548. Users on Ubuntu or Debian should apply the distribution-supplied security update when released, tracked under Debian bug #1107317. For deployments where immediate upgrading is not feasible, a targeted workaround is to restrict the application's accepted image formats at the input boundary - for example, filtering out .icns file extensions at upload or ingestion points, or using QImageReader format filtering at the application layer to exclude ICNS from the supported format list; note this will break legitimate macOS icon display functionality. Applications that never process ICNS files (i.e., only handle JPEG, PNG, etc.) are not exposed and require no action beyond the routine upgrade cycle.

More in Qt

View all
CVE-2020-12267 CRITICAL POC
9.8 Apr 27

setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
CVE-2023-37369 HIGH POC
7.5 Aug 20

In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
CVE-2020-13962 HIGH POC
7.5 Jun 09

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
CVE-2020-0570 HIGH POC
7.3 Sep 14

Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
CVE-2024-36048 CRITICAL
9.8 May 18

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
CVE-2017-10904 CRITICAL
9.8 Dec 16

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
CVE-2023-51714 CRITICAL
9.8 Dec 24

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before

CVE-2018-19873 CRITICAL
9.8 Dec 26

An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2016-10040 MEDIUM POC
5.5 Mar 07

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (applic
CVE-2018-19870 HIGH
8.8 Dec 26

An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
CVE-2018-15518 HIGH
8.8 Dec 26

QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
CVE-2026-12593 HIGH
8.7 Jul 09

Privilege escalation in the Qt Axivion Dashboard allows an authenticated low-privileged user to mint API tokens for othe

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
qt6-imageformats
Release Status Version
jammy needs-triage -
noble needs-triage -
upstream needs-triage -
plucky ignored end of life, was needs-triage
oracular ignored end of life, was needs-triage
questing needs-triage -
qtimageformats-opensource-src
Release Status Version
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
upstream needs-triage -
plucky ignored end of life, was needs-triage
oracular ignored end of life, was needs-triage
questing needs-triage -

Debian

Bug #1107317
qt6-imageformats
Release Status Fixed Version Urgency
bookworm vulnerable 6.4.2-1 -
trixie fixed 6.8.2-4 -
forky, sid fixed 6.9.2-3 -
(unstable) fixed 6.8.2-4 -
qtimageformats-opensource-src
Release Status Fixed Version Urgency
bullseye vulnerable 5.15.2-2 -
bookworm vulnerable 5.15.8-2 -
trixie fixed 5.15.15-4 -
forky, sid fixed 5.15.17-2 -
(unstable) fixed 5.15.15-4 -

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2025-5683 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy