CVE catalog

CVE-2025-23050

qt6-connectivity: CVE-2025-23050

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 27, 2026

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianqt6-connectivitysid6.11.2-2fixed
Debianqt6-connectivityforky6.11.2-2fixed
Debianqt6-connectivitytrixie6.8.2-3fixed
Debianqt6-connectivitybookworm6.4.2-1vulnerable
Debianqtconnectivity-opensource-srctrixie5.15.15-3fixed
Debianqtconnectivity-opensource-srcbookworm5.15.8-2vulnerable
Ubuntuqtconnectivity-opensource-src16.045.4.2-2build1vulnerable
Ubuntuqtconnectivity-opensource-src16.045.5.1-2build1vulnerable
Ubuntuqtconnectivity-opensource-src18.045.9.1-2vulnerable
Ubuntuqtconnectivity-opensource-src18.045.9.2-2build1vulnerable
Ubuntuqtconnectivity-opensource-src18.045.9.3-0ubuntu1vulnerable
Ubuntuqtconnectivity-opensource-src18.045.9.4-0ubuntu1vulnerable
Ubuntuqtconnectivity-opensource-src18.045.9.5-0ubuntu1vulnerable
Ubuntuqtconnectivity-opensource-src20.045.12.4-1vulnerable
Ubuntuqtconnectivity-opensource-src20.045.12.5-1vulnerable
Ubuntuqtconnectivity-opensource-src20.045.12.5-1build1vulnerable
Ubuntuqtconnectivity-opensource-src20.045.12.8-0ubuntu1vulnerable
Ubuntuqt6-connectivity22.046.2.2-2vulnerable
Ubuntuqt6-connectivity22.046.2.4-1vulnerable
Ubuntuqtconnectivity-opensource-src22.045.15.2-2vulnerable
Ubuntuqtconnectivity-opensource-src22.045.15.3-1vulnerable
Ubuntuqt6-connectivity24.046.4.2-4vulnerable
Ubuntuqt6-connectivity24.046.4.2-5vulnerable
Ubuntuqt6-connectivity24.046.4.2-5build1vulnerable
Ubuntuqt6-connectivity24.046.4.2-5build2vulnerable
Ubuntuqtconnectivity-opensource-src24.045.15.10-2vulnerable
Ubuntuqtconnectivity-opensource-src24.045.15.12-1vulnerable
Ubuntuqtconnectivity-opensource-src24.045.15.12-1build1vulnerable
Ubuntuqtconnectivity-opensource-src24.045.15.12-1build2vulnerable
Ubuntuqtconnectivity-opensource-src24.045.15.13-1vulnerable
Ubuntuqtconnectivity-opensource-src25.105.15.17-1vulnerable
Suseqt6-connectivitypackage hub 15 sp66.6.3-bp156.2.3.1fixed
Suseqt6-connectivity-docspackage hub 15 sp66.6.3-bp156.2.3.1fixed
Opensuseqt6-connectivityleap 15.66.6.3-bp156.2.3.1fixed
Opensuseqt6-connectivity-docsleap 15.66.6.3-bp156.2.3.1fixed
Opensuseqt6-connectivitytumbleweed6.8.1-2.1fixed
Opensuselibqt5-qtconnectivitytumbleweed5.15.16+kde2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianqt6-connectivitysourcesid6.7.2-8not yet assignedNot reportedNot reported
Debianqt6-connectivitysourceforky6.7.2-8not yet assignedNot reportedNot reported
Debianqt6-connectivitysourcetrixie6.7.2-8not yet assignedNot reportedNot reported
Debianqt6-connectivitysourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianqtconnectivity-opensource-srcsourcetrixie5.15.15-3not yet assignedNot reported[1093882]
Debianqtconnectivity-opensource-srcsourcebookworm(unfixed)not yet assignedNot reported[1093882]
Suseqt6-connectivityrpmpackage hub 15 sp66.6.3-bp156.2.3.1Not reportedOPENSUSE-SU-2025:0033-1Not reported
Suseqt6-connectivity-docsrpmpackage hub 15 sp66.6.3-bp156.2.3.1Not reportedOPENSUSE-SU-2025:0033-1Not reported
Opensuseqt6-connectivityrpmleap 15.66.6.3-bp156.2.3.1Not reportedOPENSUSE-SU-2025:0033-1Not reported
Opensuseqt6-connectivity-docsrpmleap 15.66.6.3-bp156.2.3.1Not reportedOPENSUSE-SU-2025:0033-1Not reported
Opensuseqt6-connectivityrpmtumbleweed6.8.1-2.1Not reportedOPENSUSE-SU-2025:14692-1Not reported
Opensuselibqt5-qtconnectivityrpmtumbleweed5.15.16+kde2-1.1Not reportedOPENSUSE-SU-2025:14716-1Not reported

[Debian bug #1093882]

Notes

[bookworm] qt6-connectivity: Minor issue [bookworm] qtconnectivity-opensource-src: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libqt5bluetooth5]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [libqt5bluetooth5-bin]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [libqt5nfc5]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [libqt6bluetooth6]Affected

    Source package: [qt6-connectivity]

    Details (2)

    • 6.4.2-1 · amd64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

    • 6.4.2-1 · arm64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

  • [libqt6bluetooth6-bin]Affected

    Source package: [qt6-connectivity]

    Details (2)

    • 6.4.2-1 · amd64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

    • 6.4.2-1 · arm64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

  • [libqt6nfc6]Affected

    Source package: [qt6-connectivity]

    Details (2)

    • 6.4.2-1 · amd64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

    • 6.4.2-1 · arm64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

  • [qml-module-qtbluetooth]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [qml-module-qtnfc]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [qt6-connectivity-dev]Affected

    Source package: [qt6-connectivity]

    Details (2)

    • 6.4.2-1 · amd64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

    • 6.4.2-1 · arm64 · bookworm

      Affected

      dsa · qt6-connectivity · debian · bookworm; dsa · qt6-connectivity · debian · 12

  • [qtconnectivity5-dev]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [qtconnectivity5-doc]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · all · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · all · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [qtconnectivity5-doc-html]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · all · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · all · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

  • [qtconnectivity5-examples]Affected

    Source package: [qtconnectivity-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtconnectivity-opensource-src · debian · bookworm; dsa · qtconnectivity-opensource-src · debian · 12

[openSUSE Tumbleweed]

  • [libQt5Bluetooth5]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libQt5Bluetooth5-32bit]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libQt5Bluetooth5-imports]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libQt5Nfc5]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libQt5Nfc5-32bit]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libQt5Nfc5-imports]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

  • [libqt5-qtconnectivity-devel]Unknown

    Source package: [libqt5-qtconnectivity]

    Details (1)

    • 5.15.19+kde0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.16+kde2-1.1

      Version impact unknown

      dsa · libqt5-qtconnectivity · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]