Qt
Monthly
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.
QDomDocument, Qt's DOM-based XML parser, crashes when processing maliciously crafted XML with extreme element nesting depth, exploiting uncontrolled recursion (CWE-674) to exhaust the call stack and terminate the host application. Any Qt-based application that passes attacker-influenced content to QDomDocument is affected across the Qt version range identified by cpe:2.3:a:qt:qt:*. No public exploit or active exploitation has been identified at time of analysis; the Qt Project has issued a patch via its code review platform.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Qt Axivion Dashboard allows an authenticated low-privileged user to mint API tokens for other, higher-privileged accounts via the undocumented POST /api/users/~/{user}/tokens endpoint, which failed to enforce an authorization check on the target user. An attacker who knows a more-privileged user's login name and can log in through the Dashboard's OAuth/OIDC flow can forge and finalize a token for that account, potentially seizing Dashboard Administrator rights and — chained with a separate weakness — achieving code execution on the host. CVSS 4.0 is rated 8.7 (High); there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Type confusion in Qt SVG renderer allows remote denial of service through malicious SVG images. Attackers can craft SVG files with self-referencing marker elements that trigger out-of-bounds heap reads and infinite recursion, crashing applications that parse the SVG. Affects Qt 6.7.0-6.8.7 and 6.9.0-6.11.0. Vendor patch available via code review platform. CVSS 8.7 reflects network delivery vector with no authentication required, though actual exploitation requires victim to open or render the crafted SVG file.
Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.
Device halt - an availability-only denial of service - in Qt for MCUs is triggered when a Text element rendering styled (rich) text encounters an <img> tag with an attribute whose value is empty, causing an internal validation check to fail and the default error handler to abort execution. Per the CVSS vectors (PR:N/UI:N) the trigger is reachable without authentication or user interaction, but exposure is conditional: only applications that parse styled markup and allow attacker-influenced text into the Text element are affected, and plain-text Text elements are not. There is no code execution, data disclosure, or integrity impact, and no public exploit has been identified at time of analysis (CVSS E:U).
Authentication bypass in the Qt VNC Server module allows a remote, unauthenticated attacker to join a shared application session without knowing the configured VNC password by connecting with a modified client that violates the RFB protocol during the handshake, exposing the confidentiality and integrity of the shared session (no availability impact, VA:N). Exposure is conditional: a reachable Qt VNC Server instance must be actively sharing an application session and using the module's built-in password authentication, which is why the independent assessment rates this a genuine but conditional MEDIUM risk (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N) rather than an urgent one. No public exploit code was identified at time of analysis (CVSS 4.0 E:U, no CISA KEV listing), and a vendor fix is available.
Stack exhaustion in Qt's QXmlStreamReader::readElementText() lets a crafted XML document with deeply nested elements crash applications built on Qt 5.0.0 through 6.8.8 or 6.9.0 through 6.11.1 that parse attacker-influenced XML through that API. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 PR:N) but requires the application, or a user, to actually process the malicious document (UI:P), and its only demonstrated impact is a recoverable crash of the parsing application - no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; the supplied CVSS 4.0 base score is 2.3, making this a genuinely low-priority issue despite Qt's massive install base, and the vendor has published a patch.
Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.
An out-of-bounds read in the HTTP Cache-Control response header parser of the QtNetwork module lets a hostile or compromised HTTP server crash 64-bit client applications built on Qt 6.0.0-6.8.8 or 6.9.0-6.11.1 that use QNetworkAccessManager. The trigger is an excessively large Cache-Control header value returned to the requesting client; because the over-read is read-only, the outcome is limited to a denial of service (application crash) with no information disclosure and no code execution, and only the client side of the connection is affected - 32-bit builds are not affected. No public exploit code has been identified at time of analysis, and exploitation is not on-demand against an arbitrary target: the victim application must be induced to connect to an untrusted, attacker-controlled, or compromised server (reflected as AT:P in the CVSS 4.0 vector), which keeps real-world risk at a low-to-moderate level despite the presence of RCE and Information Disclosure tags in some feeds.
Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. No active exploitation has been confirmed and no public exploit code exists, but the zero-privilege requirement lowers the bar for a physically proximate adversary.
XML injection in Qt's QDom serialization component (versions 4.0.0 through 6.11) allows untrusted text passed to comment, CDATA, and processing-instruction nodes to break out of those structures and inject arbitrary XML markup into serialized output, because the default InvalidDataPolicy (AcceptInvalidChars) does not escape node terminators such as '-->', ']]>', or '?>'. The CVSS 4.0 score of 2.9 reflects an attack timing prerequisite (AT:P) - only applications that actively pass attacker-controlled content through QDom serialization are exploitable; the Qt library itself is not a standalone attack surface. No public exploit is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 threat metric E:P suggests proof-of-concept code may exist.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Open redirect in Axivion Dashboard's OAuth/OIDC login flow allows an attacker to silently redirect an authenticated user to an arbitrary external URL after successful sign-in. All Axivion versions are affected per the wildcard CPE (cpe:2.3:a:qt:axivion:*). A threat actor can exploit this for phishing - credential harvesting or second-factor theft - by embedding a crafted login URL that terminates on a convincing look-alike site rather than the legitimate dashboard. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Uncontrolled search path in Qt Network's OpenSSL TLS backend on Unix allows a high-privileged local attacker to inject a rogue CA certificate by placing a crafted certificate file in the application's working directory, causing Qt-based applications to treat it as a trusted system authority. Affected across multiple long-term support branches: Qt 5.x through 5.15.19, Qt 6.0-6.5.x through 6.5.9, Qt 6.6-6.8.x through 6.8.3, and Qt 6.9.x through 6.9.1 on Unix platforms. No public exploit identified at time of analysis, and CVSS 4.0 rates this at 1.8, reflecting substantial preconditions that severely limit real-world impact.
Code injection in Qt SVG module allows attackers to execute arbitrary QML/JavaScript when applications load malicious SVG files through Qt Quick's VectorImage component. Exploitation requires local file access and user interaction (opening crafted SVG). While QML execution is more restricted than native code, attackers can still trigger denial of service, exfiltrate application data, or manipulate UI logic depending on the victim application's privilege context. No active exploitation confirmed (not in CISA KEV), but patch available from Qt Project reduces urgency for immediate emergency response.
QImage's ICNS format parser in Qt crashes when loading a specifically crafted Apple Icon Image (ICNS) file, resulting in a denial-of-service condition affecting any application that processes ICNS images. The vulnerability spans three Qt release branches - 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0 - making it broadly applicable across the Qt ecosystem. No active exploitation has been identified (EPSS 0.04%, 13th percentile; not in CISA KEV), but the wide version range and Qt's prevalence in cross-platform desktop and embedded applications give it meaningful exposure.
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An issue was discovered in Qt before 5.11.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
An issue was discovered in Qt before 5.11.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments,. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity.
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.
QDomDocument, Qt's DOM-based XML parser, crashes when processing maliciously crafted XML with extreme element nesting depth, exploiting uncontrolled recursion (CWE-674) to exhaust the call stack and terminate the host application. Any Qt-based application that passes attacker-influenced content to QDomDocument is affected across the Qt version range identified by cpe:2.3:a:qt:qt:*. No public exploit or active exploitation has been identified at time of analysis; the Qt Project has issued a patch via its code review platform.
Stack exhaustion via uncontrolled recursion in Qt's QDomDocument XML serialization allows a remote attacker to crash any Qt application that processes untrusted XML input, resulting in a denial-of-service condition. Affected applications using the QtXml module parse attacker-supplied deeply nested XML documents, triggering recursive descent without a depth guard until the call stack is exhausted. No code execution is possible; impact is limited to application availability. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Qt Axivion Dashboard allows an authenticated low-privileged user to mint API tokens for other, higher-privileged accounts via the undocumented POST /api/users/~/{user}/tokens endpoint, which failed to enforce an authorization check on the target user. An attacker who knows a more-privileged user's login name and can log in through the Dashboard's OAuth/OIDC flow can forge and finalize a token for that account, potentially seizing Dashboard Administrator rights and — chained with a separate weakness — achieving code execution on the host. CVSS 4.0 is rated 8.7 (High); there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Type confusion in Qt SVG renderer allows remote denial of service through malicious SVG images. Attackers can craft SVG files with self-referencing marker elements that trigger out-of-bounds heap reads and infinite recursion, crashing applications that parse the SVG. Affects Qt 6.7.0-6.8.7 and 6.9.0-6.11.0. Vendor patch available via code review platform. CVSS 8.7 reflects network delivery vector with no authentication required, though actual exploitation requires victim to open or render the crafted SVG file.
Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.
Device halt - an availability-only denial of service - in Qt for MCUs is triggered when a Text element rendering styled (rich) text encounters an <img> tag with an attribute whose value is empty, causing an internal validation check to fail and the default error handler to abort execution. Per the CVSS vectors (PR:N/UI:N) the trigger is reachable without authentication or user interaction, but exposure is conditional: only applications that parse styled markup and allow attacker-influenced text into the Text element are affected, and plain-text Text elements are not. There is no code execution, data disclosure, or integrity impact, and no public exploit has been identified at time of analysis (CVSS E:U).
Authentication bypass in the Qt VNC Server module allows a remote, unauthenticated attacker to join a shared application session without knowing the configured VNC password by connecting with a modified client that violates the RFB protocol during the handshake, exposing the confidentiality and integrity of the shared session (no availability impact, VA:N). Exposure is conditional: a reachable Qt VNC Server instance must be actively sharing an application session and using the module's built-in password authentication, which is why the independent assessment rates this a genuine but conditional MEDIUM risk (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N) rather than an urgent one. No public exploit code was identified at time of analysis (CVSS 4.0 E:U, no CISA KEV listing), and a vendor fix is available.
Stack exhaustion in Qt's QXmlStreamReader::readElementText() lets a crafted XML document with deeply nested elements crash applications built on Qt 5.0.0 through 6.8.8 or 6.9.0 through 6.11.1 that parse attacker-influenced XML through that API. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 PR:N) but requires the application, or a user, to actually process the malicious document (UI:P), and its only demonstrated impact is a recoverable crash of the parsing application - no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; the supplied CVSS 4.0 base score is 2.3, making this a genuinely low-priority issue despite Qt's massive install base, and the vendor has published a patch.
Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.
An out-of-bounds read in the HTTP Cache-Control response header parser of the QtNetwork module lets a hostile or compromised HTTP server crash 64-bit client applications built on Qt 6.0.0-6.8.8 or 6.9.0-6.11.1 that use QNetworkAccessManager. The trigger is an excessively large Cache-Control header value returned to the requesting client; because the over-read is read-only, the outcome is limited to a denial of service (application crash) with no information disclosure and no code execution, and only the client side of the connection is affected - 32-bit builds are not affected. No public exploit code has been identified at time of analysis, and exploitation is not on-demand against an arbitrary target: the victim application must be induced to connect to an untrusted, attacker-controlled, or compromised server (reflected as AT:P in the CVSS 4.0 vector), which keeps real-world risk at a low-to-moderate level despite the presence of RCE and Information Disclosure tags in some feeds.
Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. No active exploitation has been confirmed and no public exploit code exists, but the zero-privilege requirement lowers the bar for a physically proximate adversary.
XML injection in Qt's QDom serialization component (versions 4.0.0 through 6.11) allows untrusted text passed to comment, CDATA, and processing-instruction nodes to break out of those structures and inject arbitrary XML markup into serialized output, because the default InvalidDataPolicy (AcceptInvalidChars) does not escape node terminators such as '-->', ']]>', or '?>'. The CVSS 4.0 score of 2.9 reflects an attack timing prerequisite (AT:P) - only applications that actively pass attacker-controlled content through QDom serialization are exploitable; the Qt library itself is not a standalone attack surface. No public exploit is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 threat metric E:P suggests proof-of-concept code may exist.
Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Open redirect in Axivion Dashboard's OAuth/OIDC login flow allows an attacker to silently redirect an authenticated user to an arbitrary external URL after successful sign-in. All Axivion versions are affected per the wildcard CPE (cpe:2.3:a:qt:axivion:*). A threat actor can exploit this for phishing - credential harvesting or second-factor theft - by embedding a crafted login URL that terminates on a convincing look-alike site rather than the legitimate dashboard. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Uncontrolled search path in Qt Network's OpenSSL TLS backend on Unix allows a high-privileged local attacker to inject a rogue CA certificate by placing a crafted certificate file in the application's working directory, causing Qt-based applications to treat it as a trusted system authority. Affected across multiple long-term support branches: Qt 5.x through 5.15.19, Qt 6.0-6.5.x through 6.5.9, Qt 6.6-6.8.x through 6.8.3, and Qt 6.9.x through 6.9.1 on Unix platforms. No public exploit identified at time of analysis, and CVSS 4.0 rates this at 1.8, reflecting substantial preconditions that severely limit real-world impact.
Code injection in Qt SVG module allows attackers to execute arbitrary QML/JavaScript when applications load malicious SVG files through Qt Quick's VectorImage component. Exploitation requires local file access and user interaction (opening crafted SVG). While QML execution is more restricted than native code, attackers can still trigger denial of service, exfiltrate application data, or manipulate UI logic depending on the victim application's privilege context. No active exploitation confirmed (not in CISA KEV), but patch available from Qt Project reduces urgency for immediate emergency response.
QImage's ICNS format parser in Qt crashes when loading a specifically crafted Apple Icon Image (ICNS) file, resulting in a denial-of-service condition affecting any application that processes ICNS images. The vulnerability spans three Qt release branches - 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0 - making it broadly applicable across the Qt ecosystem. No active exploitation has been identified (EPSS 0.04%, 13th percentile; not in CISA KEV), but the wide version range and Qt's prevalence in cross-platform desktop and embedded applications give it meaningful exposure.
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access. Rated medium severity (CVSS 5.7), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
An issue was discovered in Qt before 5.11.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
An issue was discovered in Qt before 5.11.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments,. Rated low severity (CVSS 3.6), this vulnerability is low attack complexity.