Log in Start free

Vulnerability · Published Dec 3, 2025 · Assigned by TQtC

CVE-2025-12385Improper validation of <img> tag size in Text component parser

High 8.7

In plain English

A high-severity resource allocation without limits in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.3%top 72.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-declarativeno fix listedDEBIAN-CVE-2025-12385
Debian:13qt6-declarativeno fix listedDEBIAN-CVE-2025-12385
Debian:14qt6-declarativeno fix listedDEBIAN-CVE-2025-12385
Debian:12qtdeclarative-opensource-srcno fix listedDEBIAN-CVE-2025-12385
Debian:13qtdeclarative-opensource-srcno fix listedDEBIAN-CVE-2025-12385
Debian:14qtdeclarative-opensource-src5.15.17+dfsg-4DEBIAN-CVE-2025-12385
Debian:12qtdeclarative-opensource-src-glesno fix listedDEBIAN-CVE-2025-12385
Debian:13qtdeclarative-opensource-src-glesno fix listedDEBIAN-CVE-2025-12385
Debian:14qtdeclarative-opensource-src-glesno fix listedDEBIAN-CVE-2025-12385
Ubuntu:22.04:LTSqt6-declarativeno fix listedUBUNTU-CVE-2025-12385
Ubuntu:24.04:LTSqt6-declarativeno fix listedUBUNTU-CVE-2025-12385
Ubuntu:25.10qt6-declarativeno fix listedUBUNTU-CVE-2025-12385
Ubuntu:26.04:LTSqt6-declarativeno fix listedUBUNTU-CVE-2025-12385
Ubuntu:26.10qt6-declarativeno fix listedUBUNTU-CVE-2025-12385
Ubuntu:25.10qtdeclarative-opensource-srcno fix listedUBUNTU-CVE-2025-12385
Ubuntu:22.04:LTSqtdeclarative-opensource-src-glesno fix listedUBUNTU-CVE-2025-12385
Ubuntu:24.04:LTSqtdeclarative-opensource-src-glesno fix listedUBUNTU-CVE-2025-12385
Ubuntu:25.10qtdeclarative-opensource-src-glesno fix listedUBUNTU-CVE-2025-12385
Ubuntu:26.04:LTSqtdeclarative-opensource-src-glesno fix listedUBUNTU-CVE-2025-12385
Ubuntu:26.10qtdeclarative-opensource-src-glesno fix listedUBUNTU-CVE-2025-12385

Affected products (as reported)

VendorProductVersions
Qt Qt 5.0.0 – through 6.5.106.6.0 – through 6.8.56.9.0 – through 6.10.0

Weakness: CWE-770, CWE-1284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References