Read the docs
TI-2025-04901 Aliases CVE-2025-5455GHSA-5cfg-qhv9-4842

Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.004 34th percentileScored 2026-11-07
Fix Partial Qt (Qt): 6.5.9, 6.8.4, 6.9.1Red Hat: 3 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtQtup to 5.15.18; 6.0.0 – 6.5.8; 6.6.0 – 6.8.3; 6.9.06.5.9, 6.8.4, 6.9.1Patch availableCNA
  • Qt Vendorqt Affected up to 5.15.18; 6.0.0 – 6.5.8; 6.6.0 – 6.8.3; 6.9.0 Fixed in 6.5.9, 6.8.4, 6.9.1 Patch available CNA

Remediation

  • Fix · CNA Qt (Qt) Fixed in 6.5.9, 6.8.4, 6.9.1

Red Hat 3 advisories

  • RHSA-2025:11841 Released 2025-07-28 · Red Hat rating Moderate
    qt5-qtbase security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) qt5-qtbase-static-5.15.9-11.el9_4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) qt5-qtbase-5.15.9-11.el9_4, qt5-qtbase-common-5.15.9-11.el9_4, qt5-qtbase-devel-5.15.9-11.el9_4 +6
  • RHSA-2025:9462 Released 2025-06-24 · Red Hat rating Moderate
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream (v. 9) qt5-qtbase-5.15.9-11.el9_6, qt5-qtbase-common-5.15.9-11.el9_6, qt5-qtbase-devel-5.15.9-11.el9_6 +6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) qt5-qtbase-static-5.15.9-11.el9_6
  • RHSA-2025:9486 Released 2025-06-24 · Red Hat rating Moderate
    qt6-qtbase security update
    • Red Hat Enterprise Linux AppStream (v. 10) qt6-qtbase-6.8.1-9.el10_0, qt6-qtbase-common-6.8.1-9.el10_0, qt6-qtbase-devel-6.8.1-9.el10_0 +4
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) qt6-qtbase-examples-6.8.1-9.el10_0, qt6-qtbase-private-devel-6.8.1-9.el10_0, qt6-qtbase-static-6.8.1-9.el10_0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:11841
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:9486
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:9462
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:11841
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:9486
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:9462

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5455
  2. 2026-10-03 Alias added: GHSA-5cfg-qhv9-4842

References

Other 1

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences