8.4
High
CVE-2025-5455 An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and…
Description
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Qt | 6.9.0 | 6.9.1 |
| Qt 6.8 | earliest → < 6.8.4 | 6.8.4 |
| Qt 6.6 | 6.6.0 → 6.8.3 | No fix stated |
| Qt 6.5 | earliest → < 6.5.9 | 6.5.9 |
| Qt 6.0 | 6.0.0 → 6.5.8 | No fix stated |
| Qt 5.15 | earliest → 5.15.18 | No fix stated |
| Qt | 6.9.0 | 6.9.1 |
| Qt 6.8 | earliest → < 6.8.4 | 6.8.4 |
| Qt 6.6 | 6.6.0 → 6.8.3 | No fix stated |
Other CVEs of Qt
The 13 CVEs of Qt →
CVE-2025-14575
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework…
1.8
Low
CVE-2026-6210
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image
8.7
High
CVE-2025-14576
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading…
7.4
High
CVE-2025-12385
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability…
8.7
High