8.4
Élevée
CVE-2025-5455 An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and…
Description
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Qt | 6.9.0 | 6.9.1 |
| Qt 6.8 | premières → < 6.8.4 | 6.8.4 |
| Qt 6.6 | 6.6.0 → 6.8.3 | Pas de correctif indiqué |
| Qt 6.5 | premières → < 6.5.9 | 6.5.9 |
| Qt 6.0 | 6.0.0 → 6.5.8 | Pas de correctif indiqué |
| Qt 5.15 | premières → 5.15.18 | Pas de correctif indiqué |
| Qt | 6.9.0 | 6.9.1 |
| Qt 6.8 | premières → < 6.8.4 | 6.8.4 |
| Qt 6.6 | 6.6.0 → 6.8.3 | Pas de correctif indiqué |
Autres CVE de Qt
Les 13 CVE de Qt →
CVE-2025-14575
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework…
1.8
Faible
CVE-2026-6210
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image
8.7
Élevée
CVE-2025-14576
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading…
7.4
Élevée
CVE-2025-12385
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability…
8.7
Élevée