CVE catalog

CVE-2025-12385

Qt Declarative vulnerability

[CVE catalog]

Severity
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianqt6-declarativesid6.11.2+dfsg-3vulnerable
Debianqt6-declarativeforky6.11.2+dfsg-3vulnerable
Debianqt6-declarativetrixie6.8.2+dfsg-7vulnerable
Debianqt6-declarativebookworm6.4.2+dfsg-1vulnerable
Debianqtdeclarative-opensource-srcsid5.15.19+dfsg-2fixed
Debianqtdeclarative-opensource-srcforky5.15.19+dfsg-2fixed
Debianqtdeclarative-opensource-srctrixie5.15.15+dfsg-3vulnerable
Debianqtdeclarative-opensource-srcbookworm5.15.8+dfsg-3vulnerable
Debianqtdeclarative-opensource-src-glessid5.15.19+dfsg-2vulnerable
Debianqtdeclarative-opensource-src-glesforky5.15.19+dfsg-2vulnerable
Debianqtdeclarative-opensource-src-glestrixie5.15.15+dfsg-2vulnerable
Debianqtdeclarative-opensource-src-glesbookworm5.15.8+dfsg-1vulnerable
Ubuntuqt6-declarativenobleNot reportedvulnerable
Ubuntuqtdeclarative-opensource-srcnobleNot reportedvulnerable
Ubuntuqtdeclarative-opensource-src-glesnobleNot reportedvulnerable
Ubuntuqtdeclarative-opensource-srcnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5qml5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5qmlmodels5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5qmlworkerscript5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5quick5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5quickparticles5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5quickshapes5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5quicktest5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntulibqt5quickwidgets5noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqmlnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-animationnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-folderlistmodelnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-qmlmodelsnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-settingsnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-sharedimagenoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qt-labs-wavefrontmeshnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtqmlnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtqml-models2noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtqml-statemachinenoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtqml-workerscript2noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick-layoutsnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick-localstoragenoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick-particles2noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick-shapesnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick-window2noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qtquick2noble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqml-module-qttestnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqmlscenenoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqt5-qmltooling-pluginsnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-devnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-dev-toolsnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-docnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-doc-devnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-doc-htmlnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-examplesnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative5-private-devnoble5.15.13+dfsg-1ubuntu0.1+esm1fixed
Ubuntuqtdeclarative-opensource-srcpro5.15.10+dfsg-2vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.12+dfsg-1vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.12+dfsg-1build1vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.12+dfsg-1build2vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.13+dfsg-1vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.13+dfsg-1ubuntu0.1vulnerable
Ubuntuqtdeclarative-opensource-srcpro5.15.13+dfsg-1ubuntu0.1+esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianqt6-declarativesourcesid(unfixed)not yet assignedNot reported[1122054]
Debianqt6-declarativesourceforky(unfixed)not yet assignedNot reported[1122054]
Debianqt6-declarativesourcetrixie(unfixed)not yet assignedNot reported[1122054]
Debianqt6-declarativesourcebookworm(unfixed)not yet assignedNot reported[1122054]
Debianqtdeclarative-opensource-srcsourcesid5.15.17+dfsg-4not yet assignedNot reported[1122055]
Debianqtdeclarative-opensource-srcsourceforky5.15.17+dfsg-4not yet assignedNot reported[1122055]
Debianqtdeclarative-opensource-srcsourcetrixie(unfixed)not yet assignedNot reported[1122055]
Debianqtdeclarative-opensource-srcsourcebookworm(unfixed)not yet assignedNot reported[1122055]
Debianqtdeclarative-opensource-src-glessourcesid(unfixed)not yet assignedNot reported[1122056]
Debianqtdeclarative-opensource-src-glessourceforky(unfixed)not yet assignedNot reported[1122056]
Debianqtdeclarative-opensource-src-glessourcetrixie(unfixed)not yet assignedNot reported[1122056]
Debianqtdeclarative-opensource-src-glessourcebookworm(unfixed)not yet assignedNot reported[1122056]
Ubuntuqtdeclarative-opensource-srcdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5qml5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5qmlmodels5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5qmlworkerscript5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5quick5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5quickparticles5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5quickshapes5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5quicktest5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntulibqt5quickwidgets5debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqmldebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-animationdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-folderlistmodeldebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-qmlmodelsdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-settingsdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-sharedimagedebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qt-labs-wavefrontmeshdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtqmldebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtqml-models2debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtqml-statemachinedebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtqml-workerscript2debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick-layoutsdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick-localstoragedebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick-particles2debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick-shapesdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick-window2debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qtquick2debnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqml-module-qttestdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqmlscenedebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqt5-qmltooling-pluginsdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-devdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-dev-toolsdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-docdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-doc-devdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-doc-htmldebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-examplesdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative5-private-devdebnoble5.15.13+dfsg-1ubuntu0.1+esm1Not reportedNot reportedNot reported
Ubuntuqtdeclarative-opensource-srcdebpro5.15.13+dfsg-1ubuntu0.1+esm1Not reportedUSN-8357-1Not reported

[Debian bug #1122054][Debian bug #1122055][Debian bug #1122056]

Notes

[trixie] qt6-declarative: Minor issue [bookworm] qt6-declarative: Minor issue [trixie] qtdeclarative-opensource-src: Minor issue [bookworm] qtdeclarative-opensource-src: Minor issue [trixie] qtdeclarative-opensource-src-gles: Minor issue [bookworm] qtdeclarative-opensource-src-gles: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libqt5qml5]Affected

    Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • [libqt5quick5]Affected

    Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src-gles]

    Details (2)
    • 5.15.8+dfsg-1 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src-gles · debian · bookworm; usn · qtdeclarative-opensource-src-gles · debian · 12

    • 5.15.8+dfsg-1 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src-gles · debian · bookworm; usn · qtdeclarative-opensource-src-gles · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src-gles]

    Details (2)
    • 5.15.8+dfsg-1 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src-gles · debian · bookworm; usn · qtdeclarative-opensource-src-gles · debian · 12

    • 5.15.8+dfsg-1 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src-gles · debian · bookworm; usn · qtdeclarative-opensource-src-gles · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qtdeclarative-opensource-src]

    Details (2)
    • 5.15.8+dfsg-3 · amd64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

    • 5.15.8+dfsg-3 · arm64 · bookworm

      Affected

      usn · qtdeclarative-opensource-src · debian · bookworm; usn · qtdeclarative-opensource-src · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • [libqt6qml6]Affected

    Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • [libqt6qmlcore6]Affected

    Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

  • Source package: [qt6-declarative]

    Details (2)
    • 6.4.2+dfsg-1 · amd64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

    • 6.4.2+dfsg-1 · arm64 · bookworm

      Affected

      usn · qt6-declarative · debian · bookworm; usn · qt6-declarative · debian · 12

Next results

Observed:

References