Which versions of Qt Framework are affected by CVE-2025-6338?

A critical denial-of-service vulnerability in Qt's Windows TLS implementation affects all enterprise and consumer applications built with Qt versions 5.15.0-6.8.3 and 6.9.0-6.9.1, enabling attackers…

How to fix or mitigate CVE-2025-6338?

Within 24 hours, inventory all Windows-deployed applications built with Qt, document their version numbers, and identify which are business-critical or internet-facing. Within 7 days, where technically feasible, reconfigure affected applications to use OpenSSL as the TLS backend instead of Schannel, implement per-source connection rate limits, and deploy network-layer defenses (WAF rules or load balancer throttling) to block rapid TLS connection patterns. Within 30 days, establish automated monitoring for Qt security advisories, prioritize testing of Qt 6.8.4+ and 6.9.2+ when released, and schedule patching of all affected applications within 48 hours of vendor release.

Qt Framework CVE-2025-6338

Q: What is the CVSS score of CVE-2025-6338?

CVE-2025-6338 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

CRITICAL

Incomplete Cleanup (CWE-459)

2025-10-16 a59d8014-47c4-4630-ab43-e1b13cbe58e3

Denial Of Service Microsoft

9.2

CVSS 4.0 · Vendor: a59d8014-47c4-4630-ab43-e1b13cbe58e3

Severity by source

Vendor (a59d8014-47c4-4630-ab43-e1b13cbe58e3) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated TLS trigger (AV:N/AC:L/PR:N/UI:N), availability-only via slow resource leak, scored scope-unchanged (S:U) as impact hits the Qt process, unlike the vendor's SA:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (a59d8014-47c4-4630-ab43-e1b13cbe58e3).

CVSS VectorVendor: a59d8014-47c4-4630-ab43-e1b13cbe58e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:31 vuln.today

CVE Published

Oct 16, 2025 - 10:15 cve.org

CRITICAL 9.2

DescriptionCVE.org

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.

This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.

AnalysisAI

Denial of service in the Qt cross-platform application framework's Windows Schannel TLS backend (CWE-459 incomplete cleanup) lets remote attackers gradually exhaust resources by repeatedly driving TLS connections, degrading availability over a long period. It affects all Qt applications on Windows using the native Schannel TLS provider from Qt 5.15.0 through 6.8.3 and 6.9.0 through 6.9.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical), driven largely by a debatable subsequent-system availability impact.

Technical ContextAI

The flaw lives in Qt Network's TLS abstraction when backed by Microsoft Schannel (Windows' native SSPI/TLS provider), which Qt uses by default on Windows instead of OpenSSL. CWE-459 (Incomplete Cleanup) means resources allocated during the TLS/Schannel session lifecycle are not fully released, so handles, memory, or security contexts leak per connection. Over many TLS operations these leaked resources accumulate until the process - or, per the vendor scoring, the host - is starved. Applications built against affected Qt versions using QSslSocket/QNetworkAccessManager with the Schannel backend are the concrete affected surface; builds explicitly using the OpenSSL backend are not.

Affected ProductsAI

Affected is the Qt framework's Network module (Qt Network) using the Schannel TLS backend on Windows, spanning Qt 5.15.0 through 6.8.3 and Qt 6.9.0 up to but not including 6.9.2. No CPE strings were provided in the input. The vendor tracking/fix reference is the Qt code review at https://codereview.qt-project.org/c/qt/qtbase/+/651495. Non-Windows platforms and Qt builds using the OpenSSL TLS backend are outside the affected scope.

RemediationAI

Upgrade to a fixed Qt release: for the 6.9 series the fix is in Qt 6.9.2 (Vendor-released patch: 6.9.2), and the 5.15.x, 6.5.x LTS and 6.8.x lines require the corresponding backported patched builds - apply the vendor patch referenced at https://codereview.qt-project.org/c/qt/qtbase/+/651495 and rebuild affected applications, since Qt is linked into each product. As a compensating control until you can rebuild, switch the TLS backend from Schannel to OpenSSL where feasible (via QSslSocket::setActiveBackend or QT_SSL_BACKEND), accepting the trade-off of shipping and maintaining OpenSSL libraries and losing native Windows cert-store integration; alternatively place affected services behind a TLS-terminating reverse proxy so the leaky Schannel path is not directly exposed, and monitor process handle/memory counts. Because the flaw manifests slowly, scheduled process restarts are a viable stopgap for long-running services.