Log in Start free

Vulnerability · Published Apr 11, 2025 · Assigned by TQtC

CVE-2025-3512Buffer overflow in QTextMarkdownImporter

Medium 4.8

In plain English

A medium-severity heap buffer overflow in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.8Medium
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13qt6-base6.8.2+dfsg-6DEBIAN-CVE-2025-3512
Debian:14qt6-base6.8.2+dfsg-6DEBIAN-CVE-2025-3512
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-3512
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-3512
Ubuntu:25.10qt6-baseno fix listedUBUNTU-CVE-2025-3512
Ubuntu:26.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-3512
Ubuntu:26.10qt6-baseno fix listedUBUNTU-CVE-2025-3512
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-3512
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-3512
Ubuntu:25.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-3512
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-3512
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-3512

Affected products (as reported)

VendorProductVersions
Qt Qt 6.8.0 – before 6.8.4

Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Clear

References