View source for List of known vulnerabilities in Qt products

See vulnerability disclosure process from [https://www.qt.io/terms-conditions/responsible-vulnerability-disclosure-process here]

= Security advisories in Qt products =
== Qt Framework ==

=== CVE-2026-6210 ===
'''Type confusion and heap-buffer-overflow vulnerability in Qt SVG marker handling'''

'''Impact:''' A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.

'''Affected versions:''' From Qt 6.7.0 before 6.8.8, from 6.9.0 before 6.11.1.

'''Fixed:''' Qt 6.8.8 and 6.11.1

=== CVE-2025-14576 ===
'''QML Code Injection in VectorImage Component in Qt declarative module'''

'''Impact:''' Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

'''Affected versions:''' From Qt 6.8.0 to 6.8.6 and from 6.10.0 to 6.10.1

'''Fixed:''' Qt 6.8.7 and 6.10.2

=== CVE-2025-14575 ===
'''Untrusted Search Path vulnerability in OpenSSL backend certificate loading mechanism'''

'''Impact:''' An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

'''Affected versions:''' From Qt 5.0.0 to 6.5.9 and from 6.6.0 to 6.8.3 and from 6.9.0 to 6.9.1

'''Fixed:''' Qt 6.5.10 and 6.8.4 and 6.9.2

=== CVE-2025-12385 ===
'''Improper validation of <img> tag size in Text component parser in Qt declarative module''' 

'''Impact:''' This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

'''Affected versions:''' From Qt 5.0.0 to 6.5.10 and from 6.6.0 to 6.8.5 and from 6.9.0 to 6.10.0

'''Fixed:'''  Qt 6.5.11 and 6.8.6 and 6.10.1

=== CVE-2025-10729 ===
'''Use-After-Free vulnerability in Qt SVG''' 

'''Impact:''' When the module parses a <pattern> node which is not a child of a structural node, the node gets deleted after creation but might be accessed later leading to a use after free.

'''Affected versions:''' From Qt 6.7.0 to 6.8.4 and from 6.9.0 to 6.9.2.

'''Fixed:''' Qt 6.8.5 and 6.9.3.

=== CVE-2025-10728 ===
'''Uncontrolled recursion vulnerability in Qt SVG'''

'''Impact:''' When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS.

'''Affected versions:''' From Qt 6.7.0 to 6.8.4 and from 6.9.0 to 6.9.2.

'''Fixed:''' Qt 6.8.5 and 6.9.3.

=== CVE-2025-6338 ===
'''"Incomplete Cleanup" problem in Qt’s Schannel handling when it is used to provide a server handling incoming TLS connections.'''

'''Impact:''' For every connection made a 4KB file is created that is not cleaned up by the application or Qt. As a result this can cause a situation where all the available disk space is consumed. It is assumed that rebooting the computer also cleans up these files as Windows does its own cleanup, but this is not confirmed.

'''Affected versions:''' This issue affects only the Schannel functionality on Windows if it is turned on in Qt 5.15 and from Qt 6.2 when it is the default.

'''Fixed:''' Qt 6.5.10, 6.8.4 or 6.9.2.

=== CVE-2025-5992 ===
'''Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service'''

'''Impact:''' When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.

'''Affected versions:''' Qt from 6.8.0 through 6.8.3, from 6.9.0 through 6.9.1.

'''Fixed:''' Qt 6.8.4 and 6.9.2.

=== CVE-2025-5991 ===
'''Use after free in QHttp2ProtocolHandler'''

'''Impact:''' This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a POST request and the simultaneous handling of HTTP error responses.

'''Affected versions:''' Qt 6.9.0

'''Fixed:''' Qt 6.9.1.

=== CVE-2025-5683 ===
'''When loading a specifically crafted ICNS format image file then it will trigger a crash.''' 

'''Impact:''' If QImage is passed a specifically crafted ICNS format image file, then it will trigger a crash. This can happen directly via one of the load functions, or via another class which is using QImage for rendering elsewhere, such as QTextDocument.

'''Affected versions:''' All versions of Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0.

'''Fixed:''' Qt 6.5.10, 6.8.5 and 6.9.1.

=== CVE-2025-5455 ===
'''Remotely triggerable assertion in data: URL handling'''

'''Impact:''' An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service.

'''Affected versions:''' All version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.3 and 6.9.0.

'''Fixed:''' Qt 5.15.19, Qt 6.5.9, Qt 6.8.4, Qt 6.9.1.

=== CVE-2025-4211 ===
'''Improper Link Resolution Before File Access in QFileSystemEngine in the Qt corelib module on Windows'''

'''Impact:''' The vulnerability allows attackers to influence the temporary file path resolution, which can lead to elevation of privilege. This can be particularly dangerous if exploited by unprivileged users to gain higher-level access or execute arbitrary code with elevated permissions.

'''Affected versions:''' All version of Qt up to and including 5.15.18, from 6.0.0 through 6.5.8, from 6.6.0 through 6.8.1

'''Fixed:''' Qt 5.15.19, Qt 6.5.9, Qt 6.8.2 and Qt 6.9.0

=== CVE-2025-3512 ===
'''A Heap-buffer-overflow issue in QTextMarkdownImporter'''

'''Impact:''' Passing an incorrectly formatted markdown file to QTextMarkdownImporter can trigger a heap-buffer-overflow.

'''Affected versions:''' From 6.8.0 up to 6.8.3. Versions before 6.6.0 are known to be unaffected.

'''Fixed:''' 6.8.4 and 6.9.0

=== CVE-2025-30348 ===
'''A Denial-of-Service type of security issue in Qt XML module'''

'''Impact:''' When QDom classes are used to write XML with long text segments, QDomNode::save() could hit a quadratic-complexity code path, potentially leading to a DoS if an attacker can control the rate and contents of XML serializations performed by the application, e.g. if the application packages attacker-supplied text in XML, including reading XML, changing it, and writing it back.

'''Affected versions:''' ''':''' Up to 5.15.18, 6.0.0 to 6.5.8, and 6.6.0 to 6.7.3.

'''Fixed:''' 5.15.19, 6.5.9, 6.8.0 and 6.9.0.

=== CVE-2025-23050 ===
'''Read past the end of the buffer and division by zero security issue in QLowEnergyController on Linux'''

'''Impact:''' QLowEnergyController on Linux has a BlueZ DBus and a Bluetooth Kernel API backend. When using the Bluetooth Kernel API backend of QLowEnergyController, QtBluetooth creates a Bluetooth L2CAP socket to establish a connection with an external Bluetooth Low Energy device. After that, the external device can send malformed Bluetooth ATT commands to trigger read past the end of the buffer and division by zero errors. The problem is relevant for both central and peripheral roles.

For central role use cases the Bluetooth Kernel API backend is only used if the system's BlueZ runtime version is lower than 5.42. For peripheral use cases, the Bluetooth Kernel API backend is used by default for all Qt versions before Qt 6.7. Deployments using Qt 6.7 or later trigger the backend if the Bluez version is below 5.56 or the explicit opt in via the env variable QT_BLUETOOTH_USE_KERNEL_PERIPHERAL was given. In the central role the user has to explicitly connect to the attacking external device before the malformed commands are processed. In the peripheral role, the advertising should be started with the QLowEnergyAdvertisingParameters::AdvInd mode to allow the external device to connect.

'''Affected versions:''' From 5.4.0 to 5.15.18, 6.0.0 to 6.5.8, and 6.6.0 to 6.8.1.

'''Fixed:''' 5.15.19, 6.5.9, 6.8.2 and 6.9.0.

=== CVE-2024-39936 ===
'''HTTP2 vulnerability with non-matching TLS certificates'''

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed. Fixed in 5.15.19, 6.2.14, 6.5.8 and 6.7.4.

=== CVE-2024-36048 ===
'''Predictable nonces in QtNetworkAuth'''

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values. Fixed in Qt 5.15.17, 6.2.14, 6.5.6, 6.7.1.

=== CVE-2024-33861 ===
'''QStringConverter has an invalid pointer being passed as a callback which can allow modification of the stack'''

QStringConverter has an invalid pointer being passed as a callback which can allow modification of the stack. Qt itself is not vulnerable to remote attack however an application using QStringDecoder either directly or indirectly can be vulnerable. Qt does not automatically use any of those codecs, so this needs the application to implement something using QStringDecoder to be vulnerable. This affects Qt 6.5.0->6.5.5, 6.6.x and 6.7.0. Fixed in Qt 6.5.6 and 6.7.1.

=== CVE-2024-30161 ===
'''Use-After-Free in Qt for WebAssembly’s implementation of QNetworkReply'''

In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). Fixed in Qt 6.5.6 and 6.7.0.

=== CVE-2024-25580 ===
'''OOB read in QKtxHandler'''

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file. Fixed in Qt 5.15.18, 6.2.13, 6.5.6 and 6.7.0.

=== CVE-2023-51714 ===
'''Ineffective integer overflow check in HPack implementation'''

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. Fixed in Qt 5.15.18, 6.2.12, 6.5.5 and 6.7.0.

=== CVE-2023-38197 ===
'''QXMLStreamReader can freeze or get out of memory on recursive entity expansion, with DTD tokens in XML body'''

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. Fixed in Qt 5.15.16, 6.2.11, and 6.5.4.

=== CVE-2023-45872 ===
'''QML Image bad source crashes application instead of error status (QSvgHandler::parse)'''

An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service (application crash) if it is not actually an SVG document. Fixed in Qt 6.2.12 and 6.6.2.

=== CVE-2023-43114 ===
'''Crash on corrupted font data'''

An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont[FromData], then it can cause the application to crash because of missing length checks. Fixed in Qt 5.15.17, 6.2.11 and 6.5.4.

=== CVE-2023-32763 ===
'''Integer overflow in qfixed_p.h when rendering SVG image on the minimal plugin'''

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. Fixed in Qt 5.15.16, 6.2.10, and 6.5.2.

=== CVE-2023-37369 ===
'''Potential buffer overflow in QXmlStreamReader'''

In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. Fixed in Qt 5.15.16, 6.2.10, and 6.5.3.

=== CVE-2023-34410 ===
'''Possible vulnerability regarding SSL implementation in Qt'''

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. Fixed in Qt 5.15.16, 6.2.10, and 6.5.3.

=== CVE-2023-33285 ===
'''QDnsLookup buffer overflow UB on Unix'''

An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. Fixed in Qt 5.15.15, 6.2.10, and 6.5.2.

=== CVE-2023-32762 ===
'''Qt Network incorrectly parses the strict-transport-security (HSTS) header'''

An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. Fixed in Qt 5.15.15, 6.2.10, and 6.5.2.