Log in Start free

Vulnerability · Published Jun 2, 2025 · Assigned by TQtC

CVE-2025-5455Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

High 8.4

In plain English

A high-severity improper input validation in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.4High
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9qt5-qtbase5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-common5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-devel5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-examples5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-gui5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-mysql5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-odbc5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-postgresql5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-private-devel5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:9qt5-qtbase-static5.15.9-11.el9_6ALSA-2025:9462
AlmaLinux:10qt6-qtbase-common6.8.1-9.el10_0ALSA-2025:9486
Debian:12qt6-baseno fix listedDEBIAN-CVE-2025-5455
Debian:13qt6-base6.8.2+dfsg-8DEBIAN-CVE-2025-5455
Debian:14qt6-base6.8.2+dfsg-8DEBIAN-CVE-2025-5455
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2025-5455
Debian:13qtbase-opensource-src5.15.15+dfsg-6DEBIAN-CVE-2025-5455
Debian:14qtbase-opensource-src5.15.15+dfsg-6DEBIAN-CVE-2025-5455
Rocky Linux:9qt5-qtbase0:5.15.9-11.el9_6RLSA-2025:9462
Rocky Linux:10qt6-qtbase0:6.8.1-9.el10_0RLSA-2025:9486
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-5455
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-5455
Ubuntu:25.10qt6-baseno fix listedUBUNTU-CVE-2025-5455
Ubuntu:26.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-5455
Ubuntu:26.10qt6-baseno fix listedUBUNTU-CVE-2025-5455
Ubuntu:22.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-5455
Ubuntu:24.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-5455
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-5455
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-5455
Ubuntu:25.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-5455
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-5455
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-5455

Affected products (as reported)

VendorProductVersions
Qt Qt 0 – through 5.15.186.0.0 – through 6.5.86.6.0 – through 6.8.36.9.0

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/R:U/RE:M/U:Clear

References