Log in Start free

Vulnerability · Published Mar 21, 2025 · Assigned by mitre

CVE-2025-30348

Medium 5.8

In plain English

A medium-severity security flaw in Qt from Qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-baseno fix listedDEBIAN-CVE-2025-30348
Debian:13qt6-base6.8.2+dfsg-5DEBIAN-CVE-2025-30348
Debian:14qt6-base6.8.2+dfsg-5DEBIAN-CVE-2025-30348
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-30348
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2025-30348
Ubuntu:22.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-30348
Ubuntu:24.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-30348
Ubuntu:25.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2025-30348
Ubuntu:26.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2025-30348
Ubuntu:26.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2025-30348
Ubuntu:22.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-30348
Ubuntu:24.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-30348
Ubuntu:25.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-30348
Ubuntu:26.04:LTSqtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-30348
Ubuntu:26.10qtbase-opensource-src-glesno fix listedUBUNTU-CVE-2025-30348

Affected products (as reported)

VendorProductVersions
Qt Qt 0 – before 5.15.196.0.0 – before 6.5.96.6.0 – before 6.8.0

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References