Input validation error in Qt - CVE-2025-5683

Vulnerability identifier: #VU112078

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5683

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in QImage when parsing an ICNS format image file. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Qt
openEuler
Fedora
Business Automation Insights
dtk6log
zeal
nheko
kddockwidgets
LabPlot
gammaray
libqtxdg
fcitx5-qt
qt5-qtimageformats
qt5-qtimageformats-debuginfo
qt5-qtimageformats-debugsource
dtk6core
dtk6widget
dtk6gui
plasma-integration
kwin
qt6-qtimageformats-debuginfo
qt6-qtimageformats
qt6-qtimageformats-debugsource
python-pyqt6
qt6-qtwebview
qt6-qtwebsockets
qt6-qtserialbus
qt6-qtwebengine
qt6-qtwebchannel
qt6-qtwayland
qt6-qtvirtualkeyboard
qt6-qttranslations
qt6-qtcoap
qt6-qtlanguageserver
qt6-qthttpserver
qt6-qtgrpc
qt6-qtgraphs
qt6-qtdeclarative
qt6-qtdatavis3d
qt6-qtconnectivity
qt6-qtsvg
qt6-qtcharts
qt6-qtbase
qt6-qt5compat
qt6-qt3d
qt6-doc
qt6
python-pyside6
qt6-qtlottie
qt6-qttools
qt6-qtspeech
qt6-qtshadertools
qt6-qtserialport
qt6-qtsensors
qt6-qtscxml
qt6-qtremoteobjects
qt6-qtquicktimeline
qt6-qtquick3dphysics
qt6-qtquick3d
qt6-qtpositioning
qt6-qtopcua
qt6-qtnetworkauth
qt6-qtmultimedia
qt6-qtmqtt
qt6-qtlocation
qt-creator

Install updates from vendor's website.

Qt - addressed in versions 6.5.10, 6.8.5, 6.9.1
Business Automation Insights - addressed in versions 24.0.0.0.6, 24.0.1.0.6, 25.0.0.0.3
dtk6log - update to 0.0.2-7.fc42
zeal - update to 0.7.2-9.fc42
nheko - update to 0.12.0-15.fc42
kddockwidgets - update to 1.7.0-23.fc42
LabPlot - update to 2.12.0-3.fc42
gammaray - update to 3.1.0-11.fc42
libqtxdg - update to 4.1.0-6.fc42
fcitx5-qt - update to 5.1.9-7.fc42
qt5-qtimageformats - addressed in versions 5.11.1-8, 5.15.2-2, 5.15.10-2
qt5-qtimageformats-debuginfo - addressed in versions 5.11.1-8, 5.15.2-2, 5.15.10-2
qt5-qtimageformats-debugsource - addressed in versions 5.11.1-8, 5.15.2-2, 5.15.10-2
dtk6core - update to 6.0.27-5.fc42
dtk6widget - update to 6.0.27-5.fc42
dtk6gui - update to 6.0.27-6.fc42
plasma-integration - update to 6.3.5-3.fc42
kwin - update to 6.3.5-3.fc42
qt6-qtimageformats-debuginfo - update to 6.5.2-2
qt6-qtimageformats - update to 6.5.2-2
qt6-qtimageformats-debugsource - update to 6.5.2-2
python-pyqt6 - update to 6.9.0-3.fc42
qt6-qtwebview - update to 6.9.1-1.fc42
qt6-qtwebsockets - update to 6.9.1-1.fc42
qt6-qtserialbus - update to 6.9.1-1.fc42
qt6-qtwebengine - update to 6.9.1-1.fc42
qt6-qtwebchannel - update to 6.9.1-1.fc42
qt6-qtwayland - update to 6.9.1-1.fc42
qt6-qtvirtualkeyboard - update to 6.9.1-1.fc42
qt6-qttranslations - update to 6.9.1-1.fc42
qt6-qtcoap - update to 6.9.1-1.fc42
qt6-qtlanguageserver - update to 6.9.1-1.fc42
qt6-qtimageformats - update to 6.9.1-1.fc42
qt6-qthttpserver - update to 6.9.1-1.fc42
qt6-qtgrpc - update to 6.9.1-1.fc42
qt6-qtgraphs - update to 6.9.1-1.fc42
qt6-qtdeclarative - update to 6.9.1-1.fc42
qt6-qtdatavis3d - update to 6.9.1-1.fc42
qt6-qtconnectivity - update to 6.9.1-1.fc42
qt6-qtsvg - update to 6.9.1-1.fc42
qt6-qtcharts - update to 6.9.1-1.fc42
qt6-qtbase - update to 6.9.1-1.fc42
qt6-qt5compat - update to 6.9.1-1.fc42
qt6-qt3d - update to 6.9.1-1.fc42
qt6-doc - update to 6.9.1-1.fc42
qt6 - update to 6.9.1-1.fc42
python-pyside6 - update to 6.9.1-1.fc42
qt6-qtlottie - update to 6.9.1-1.fc42
qt6-qttools - update to 6.9.1-1.fc42
qt6-qtspeech - update to 6.9.1-1.fc42
qt6-qtshadertools - update to 6.9.1-1.fc42
qt6-qtserialport - update to 6.9.1-1.fc42
qt6-qtsensors - update to 6.9.1-1.fc42
qt6-qtscxml - update to 6.9.1-1.fc42
qt6-qtremoteobjects - update to 6.9.1-1.fc42
qt6-qtquicktimeline - update to 6.9.1-1.fc42
qt6-qtquick3dphysics - update to 6.9.1-1.fc42
qt6-qtquick3d - update to 6.9.1-1.fc42
qt6-qtpositioning - update to 6.9.1-1.fc42
qt6-qtopcua - update to 6.9.1-1.fc42
qt6-qtnetworkauth - update to 6.9.1-1.fc42
qt6-qtmultimedia - update to 6.9.1-1.fc42
qt6-qtmqtt - update to 6.9.1-1.fc42
qt6-qtlocation - update to 6.9.1-1.fc42
qt-creator - update to 16.0.1-2.fc42

• https://codereview.qt-project.org/c/qt/qtimageformats/+/644548
• https://issues.oss-fuzz.com/issues/415350704
• https://www.qt.io/blog/security-advisory-recently-discovered-issue-in-icns-image-format-handling-impacts-qt

• Denial of service in Trolltech Qt
• Fedora 42 update for LabPlot, dtk6core, dtk6gui, dtk6log, dtk6widget, fcitx5-qt, gammaray, kddockwidgets, kwin, libqtxdg, nheko, plasma-integration, python-pyqt6, python-pyside6, qt-creator, qt6, qt6-doc, qt6-qt3d, qt6-qt5compat, qt6-qtbase, qt6-qtcharts,
• openEuler 24.03 LTS update for qt6-qtimageformats
• openEuler 24.03 LTS SP1 update for qt6-qtimageformats
• openEuler 24.03 LTS SP2 update for qt6-qtimageformats
• openEuler 24.03 LTS update for qt5-qtimageformats
• openEuler 22.03 LTS SP4 update for qt5-qtimageformats
• openEuler 22.03 LTS SP3 update for qt5-qtimageformats
• openEuler 20.03 LTS SP4 update for qt5-qtimageformats
• openEuler 24.03 LTS SP1 update for qt5-qtimageformats
• openEuler 24.03 LTS SP2 update for qt5-qtimageformats
• Multiple vulnerabilities in IBM Business Automation Insights