8.4

CVE-2025-5455

Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.



If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).



This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerQt
≫
Produkt Qt
Default Statusunaffected
Version <= 5.15.18
Version 0
Status affected
Version <= 6.5.8
Version 6.0.0
Status affected
Version 6.5.9
Status unaffected
Version <= 6.8.3
Version 6.6.0
Status affected
Version 6.8.4
Status unaffected
Version 6.9.0
Status affected
Version 6.9.1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.246
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
a59d8014-47c4-4630-ab43-e1b13cbe58e3 8.4 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:Clear
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://codereview.qt-project.org/c/qt/qtbase/+/642006