CVE-2025-5455 (GCVE-0-2025-5455)
Vulnerability from cvelistv5
Published
2025-06-02 08:46
Modified
2025-06-02 12:42
Severity ?
8.4 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/R:U/RE:M/U:Clear
CWE
  • CWE-20 - Improper Input Validation
Summary
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
References
Impacted products
Vendor Product Version
The Qt Company Qt Version: 0
Version: 6.0.0
Version: 6.6.0
Version: 6.9.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-02T12:39:49.722519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-02T12:42:34.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Qt",
          "vendor": "The Qt Company",
          "versions": [
            {
              "lessThanOrEqual": "5.15.18",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThanOrEqual": "6.5.8",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.5.9",
              "versionType": "python"
            },
            {
              "lessThanOrEqual": "6.8.3",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.8.4",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "6.9.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.9.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\u003c/p\u003e\u003cp\u003eIf the function was called with malformed data, for example, an URL that\ncontained a \"charset\" parameter that lacked a value (such as\n\"data:charset,\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\n(abort).\u003c/p\u003e\u003cp\u003eThis impacts Qt up to 5.15.18, 6.0.0-\u0026gt;6.5.8, 6.6.0-\u0026gt;6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\n\nIf the function was called with malformed data, for example, an URL that\ncontained a \"charset\" parameter that lacked a value (such as\n\"data:charset,\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\n(abort).\n\nThis impacts Qt up to 5.15.18, 6.0.0-\u003e6.5.8, 6.6.0-\u003e6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/R:U/RE:M/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-02T08:46:20.524Z",
        "orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
        "shortName": "TQtC"
      },
      "references": [
        {
          "url": "https://codereview.qt-project.org/c/qt/qtbase/+/642006"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Possible denial of service when passing malformed data in a URL to qDecodeDataUrl",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
    "assignerShortName": "TQtC",
    "cveId": "CVE-2025-5455",
    "datePublished": "2025-06-02T08:46:20.524Z",
    "dateReserved": "2025-06-02T08:31:36.081Z",
    "dateUpdated": "2025-06-02T12:42:34.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-5455\",\"sourceIdentifier\":\"a59d8014-47c4-4630-ab43-e1b13cbe58e3\",\"published\":\"2025-06-02T09:15:21.493\",\"lastModified\":\"2025-06-02T17:32:17.397\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\\n\\nIf the function was called with malformed data, for example, an URL that\\ncontained a \\\"charset\\\" parameter that lacked a value (such as\\n\\\"data:charset,\\\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\\n(abort).\\n\\nThis impacts Qt up to 5.15.18, 6.0.0-\u003e6.5.8, 6.6.0-\u003e6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un problema en la funci\u00f3n privada de la API qDecodeDataUrl() de QtCore, utilizada en QTextDocument y QNetworkReply, y, potencialmente, en el c\u00f3digo de usuario. Si la funci\u00f3n se llamaba con datos mal formados, por ejemplo, una URL que conten\u00eda un par\u00e1metro \\\"charset\\\" sin valor (como \\\"data:charset,\\\"), y Qt se compilaba con aserciones habilitadas, se encontraba con una aserci\u00f3n, lo que resultaba en una denegaci\u00f3n de servicio (abortar). Esto afecta a Qt hasta las versiones 5.15.18, 6.0.0-\u0026gt;6.5.8, 6.6.0-\u0026gt;6.8.3 y 6.9.0. Se ha corregido en las versiones 5.15.19, 6.5.9, 6.8.4 y 6.9.1.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"a59d8014-47c4-4630-ab43-e1b13cbe58e3\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:Clear\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"USER\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"CLEAR\"}}]},\"weaknesses\":[{\"source\":\"a59d8014-47c4-4630-ab43-e1b13cbe58e3\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://codereview.qt-project.org/c/qt/qtbase/+/642006\",\"source\":\"a59d8014-47c4-4630-ab43-e1b13cbe58e3\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Qt\", \"vendor\": \"The Qt Company\", \"versions\": [{\"lessThanOrEqual\": \"5.15.18\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"python\"}, {\"lessThanOrEqual\": \"6.5.8\", \"status\": \"affected\", \"version\": \"6.0.0\", \"versionType\": \"python\"}, {\"status\": \"unaffected\", \"version\": \"6.5.9\", \"versionType\": \"python\"}, {\"lessThanOrEqual\": \"6.8.3\", \"status\": \"affected\", \"version\": \"6.6.0\", \"versionType\": \"python\"}, {\"status\": \"unaffected\", \"version\": \"6.8.4\", \"versionType\": \"python\"}, {\"status\": \"affected\", \"version\": \"6.9.0\", \"versionType\": \"python\"}, {\"status\": \"unaffected\", \"version\": \"6.9.1\", \"versionType\": \"python\"}]}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eAn issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\u003c/p\u003e\u003cp\u003eIf the function was called with malformed data, for example, an URL that\\ncontained a \\\"charset\\\" parameter that lacked a value (such as\\n\\\"data:charset,\\\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\\n(abort).\u003c/p\u003e\u003cp\u003eThis impacts Qt up to 5.15.18, 6.0.0-\u0026gt;6.5.8, 6.6.0-\u0026gt;6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.\u003c/p\u003e\u003cbr\u003e\"}], \"value\": \"An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\\n\\nIf the function was called with malformed data, for example, an URL that\\ncontained a \\\"charset\\\" parameter that lacked a value (such as\\n\\\"data:charset,\\\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\\n(abort).\\n\\nThis impacts Qt up to 5.15.18, 6.0.0-\u003e6.5.8, 6.6.0-\u003e6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.\"}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"USER\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"attackVector\": \"NETWORK\", \"baseScore\": 8.4, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"CLEAR\", \"subAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"userInteraction\": \"ACTIVE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/R:U/RE:M/U:Clear\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"a59d8014-47c4-4630-ab43-e1b13cbe58e3\", \"shortName\": \"TQtC\", \"dateUpdated\": \"2025-06-02T08:46:20.524Z\"}, \"references\": [{\"url\": \"https://codereview.qt-project.org/c/qt/qtbase/+/642006\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"title\": \"Possible denial of service when passing malformed data in a URL to qDecodeDataUrl\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-5455\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-02T12:39:49.722519Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-02T12:42:02.535Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-5455\", \"assignerOrgId\": \"a59d8014-47c4-4630-ab43-e1b13cbe58e3\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"TQtC\", \"dateReserved\": \"2025-06-02T08:31:36.081Z\", \"datePublished\": \"2025-06-02T08:46:20.524Z\", \"dateUpdated\": \"2025-06-02T12:42:34.203Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.