CVE-2025-5455

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-5455
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-5455.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-5455
Downstream
Related
Published
2025-06-02T09:15:21Z
Modified
2025-07-06T05:49:50.973669Z
Summary
[none]
Details

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort).

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

References

Affected packages

Debian:12 / qt6-base

Package

Name
qt6-base
Purl
pkg:deb/debian/qt6-base?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.4.2+dfsg-10
6.4.2+dfsg-11~bpo11+1
6.4.2+dfsg-11
6.4.2+dfsg-12
6.4.2+dfsg-13
6.4.2+dfsg-14
6.4.2+dfsg-15
6.4.2+dfsg-16
6.4.2+dfsg-17
6.4.2+dfsg-18
6.4.2+dfsg-18+loong64
6.4.2+dfsg-19
6.4.2+dfsg-20
6.4.2+dfsg-21
6.4.2+dfsg-21.1
6.6.0+dfsg-1
6.6.0+dfsg-2
6.6.0+dfsg-3
6.6.0+dfsg-4
6.6.0+dfsg-5
6.6.0+dfsg-6
6.6.1+dfsg-1
6.6.1+dfsg-2
6.6.1+dfsg-3
6.6.1+dfsg-4
6.6.1+dfsg-5
6.6.1+dfsg-6
6.6.2+dfsg-1
6.6.2+dfsg-2
6.6.2+dfsg-3
6.6.2+dfsg-4
6.6.2+dfsg-5
6.6.2+dfsg-6
6.6.2+dfsg-7
6.6.2+dfsg-8
6.6.2+dfsg-9
6.6.2+dfsg-10
6.6.2+dfsg-11
6.6.2+dfsg-12
6.7.2+dfsg-1
6.7.2+dfsg-2
6.7.2+dfsg-3
6.7.2+dfsg-4
6.7.2+dfsg-4+m68k
6.7.2+dfsg-5
6.7.2+dfsg-6
6.8.2+dfsg-1
6.8.2+dfsg-2
6.8.2+dfsg-3
6.8.2+dfsg-4
6.8.2+dfsg-5
6.8.2+dfsg-5+m68k
6.8.2+dfsg-6
6.8.2+dfsg-7
6.8.2+dfsg-8

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / qt6-base

Package

Name
qt6-base
Purl
pkg:deb/debian/qt6-base?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.8.2+dfsg-8

Affected versions

6.*

6.4.2+dfsg-10
6.4.2+dfsg-11~bpo11+1
6.4.2+dfsg-11
6.4.2+dfsg-12
6.4.2+dfsg-13
6.4.2+dfsg-14
6.4.2+dfsg-15
6.4.2+dfsg-16
6.4.2+dfsg-17
6.4.2+dfsg-18
6.4.2+dfsg-18+loong64
6.4.2+dfsg-19
6.4.2+dfsg-20
6.4.2+dfsg-21
6.4.2+dfsg-21.1
6.6.0+dfsg-1
6.6.0+dfsg-2
6.6.0+dfsg-3
6.6.0+dfsg-4
6.6.0+dfsg-5
6.6.0+dfsg-6
6.6.1+dfsg-1
6.6.1+dfsg-2
6.6.1+dfsg-3
6.6.1+dfsg-4
6.6.1+dfsg-5
6.6.1+dfsg-6
6.6.2+dfsg-1
6.6.2+dfsg-2
6.6.2+dfsg-3
6.6.2+dfsg-4
6.6.2+dfsg-5
6.6.2+dfsg-6
6.6.2+dfsg-7
6.6.2+dfsg-8
6.6.2+dfsg-9
6.6.2+dfsg-10
6.6.2+dfsg-11
6.6.2+dfsg-12
6.7.2+dfsg-1
6.7.2+dfsg-2
6.7.2+dfsg-3
6.7.2+dfsg-4
6.7.2+dfsg-4+m68k
6.7.2+dfsg-5
6.7.2+dfsg-6
6.8.2+dfsg-1
6.8.2+dfsg-2
6.8.2+dfsg-3
6.8.2+dfsg-4
6.8.2+dfsg-5
6.8.2+dfsg-5+m68k
6.8.2+dfsg-6
6.8.2+dfsg-7

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:11 / qtbase-opensource-src

Package

Name
qtbase-opensource-src
Purl
pkg:deb/debian/qtbase-opensource-src?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.15.2+dfsg-9
5.15.2+dfsg-9+deb11u1
5.15.2+dfsg-10
5.15.2+dfsg-11
5.15.2+dfsg-12
5.15.2+dfsg-13
5.15.2+dfsg-14
5.15.2+dfsg-15
5.15.2+dfsg-16
5.15.3+dfsg-1
5.15.3+dfsg-2
5.15.4+dfsg-1
5.15.4+dfsg-2
5.15.4+dfsg-3
5.15.4+dfsg-4
5.15.4+dfsg-5
5.15.5+dfsg-1
5.15.5+dfsg-2
5.15.5+dfsg-3
5.15.6+dfsg-1
5.15.6+dfsg-2
5.15.6+dfsg-3
5.15.6+dfsg-4
5.15.6+dfsg-5
5.15.7+dfsg-1
5.15.7+dfsg-2
5.15.7+dfsg-3
5.15.8+dfsg-1
5.15.8+dfsg-2
5.15.8+dfsg-3
5.15.8+dfsg-4
5.15.8+dfsg-5
5.15.8+dfsg-6
5.15.8+dfsg-7
5.15.8+dfsg-8
5.15.8+dfsg-9
5.15.8+dfsg-10
5.15.8+dfsg-11
5.15.8+dfsg-12
5.15.8+dfsg-13
5.15.9+dfsg-1
5.15.9+dfsg-2
5.15.9+dfsg-3
5.15.10+dfsg-1
5.15.10+dfsg-2
5.15.10+dfsg-3
5.15.10+dfsg-4
5.15.10+dfsg-5
5.15.10+dfsg-6
5.15.10+dfsg-7
5.15.10+dfsg-7.1
5.15.10+dfsg-7.2
5.15.11+dfsg-1
5.15.12+dfsg-1
5.15.12+dfsg-2
5.15.12+dfsg-3
5.15.13+dfsg-1
5.15.13+dfsg-2
5.15.13+dfsg-3
5.15.13+dfsg-4
5.15.14+dfsg-1
5.15.15+dfsg-1
5.15.15+dfsg-2
5.15.15+dfsg-3
5.15.15+dfsg-4
5.15.15+dfsg-5
5.15.15+dfsg-6
5.15.16+dfsg-1
5.15.16+dfsg-2
5.15.17+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / qtbase-opensource-src

Package

Name
qtbase-opensource-src
Purl
pkg:deb/debian/qtbase-opensource-src?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.15.8+dfsg-11
5.15.8+dfsg-11+deb12u1
5.15.8+dfsg-11+deb12u2
5.15.8+dfsg-11+deb12u3
5.15.8+dfsg-12
5.15.8+dfsg-13
5.15.9+dfsg-1
5.15.9+dfsg-2
5.15.9+dfsg-3
5.15.10+dfsg-1
5.15.10+dfsg-2
5.15.10+dfsg-3
5.15.10+dfsg-4
5.15.10+dfsg-5
5.15.10+dfsg-6
5.15.10+dfsg-7
5.15.10+dfsg-7.1
5.15.10+dfsg-7.2
5.15.11+dfsg-1
5.15.12+dfsg-1
5.15.12+dfsg-2
5.15.12+dfsg-3
5.15.13+dfsg-1
5.15.13+dfsg-2
5.15.13+dfsg-3
5.15.13+dfsg-4
5.15.14+dfsg-1
5.15.15+dfsg-1
5.15.15+dfsg-2
5.15.15+dfsg-3
5.15.15+dfsg-4
5.15.15+dfsg-5
5.15.15+dfsg-6
5.15.16+dfsg-1
5.15.16+dfsg-2
5.15.17+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / qtbase-opensource-src

Package

Name
qtbase-opensource-src
Purl
pkg:deb/debian/qtbase-opensource-src?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.15.15+dfsg-6

Affected versions

5.*

5.15.8+dfsg-11
5.15.8+dfsg-12
5.15.8+dfsg-13
5.15.9+dfsg-1
5.15.9+dfsg-2
5.15.9+dfsg-3
5.15.10+dfsg-1
5.15.10+dfsg-2
5.15.10+dfsg-3
5.15.10+dfsg-4
5.15.10+dfsg-5
5.15.10+dfsg-6
5.15.10+dfsg-7
5.15.10+dfsg-7.1
5.15.10+dfsg-7.2
5.15.11+dfsg-1
5.15.12+dfsg-1
5.15.12+dfsg-2
5.15.12+dfsg-3
5.15.13+dfsg-1
5.15.13+dfsg-2
5.15.13+dfsg-3
5.15.13+dfsg-4
5.15.14+dfsg-1
5.15.15+dfsg-1
5.15.15+dfsg-2
5.15.15+dfsg-3
5.15.15+dfsg-4
5.15.15+dfsg-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}