CVE catalog

CVE-2025-5455

qt6-base: CVE-2025-5455

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jun 2, 2025, 8:46:20 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.38% · Oct 25, 2026

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	qt6-base	sid	`6.11.2+dfsg-7`	fixed
Debian	qt6-base	forky	`6.11.2+dfsg-5`	fixed
Debian	qt6-base	trixie	`6.8.2+dfsg-9+deb13u2`	fixed
Debian	qt6-base	bookworm	`6.4.2+dfsg-10`	vulnerable
Debian	qtbase-opensource-src	sid	`5.15.19+dfsg-6`	fixed
Debian	qtbase-opensource-src	forky	`5.15.19+dfsg-5`	fixed
Debian	qtbase-opensource-src	trixie	`5.15.15+dfsg-6+deb13u1`	fixed
Debian	qtbase-opensource-src	bookworm	`5.15.8+dfsg-11+deb12u3`	vulnerable
Debian	qtbase-opensource-src-gles	sid	`5.15.19+dfsg-2`	not affected
Debian	qtbase-opensource-src-gles	forky	`5.15.19+dfsg-2`	not affected
Debian	qtbase-opensource-src-gles	trixie	`5.15.15+dfsg-2`	not affected
Debian	qtbase-opensource-src-gles	bookworm	`5.15.8+dfsg-3`	not affected
Opensuse	libqt5-qtbase	tumbleweed	`5.15.17+kde122-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	qt6-base	source	sid	`6.8.2+dfsg-8`	not yet assigned	Not reported	[1108474]
Debian	qt6-base	source	forky	`6.8.2+dfsg-8`	not yet assigned	Not reported	[1108474]
Debian	qt6-base	source	trixie	`6.8.2+dfsg-8`	not yet assigned	Not reported	[1108474]
Debian	qt6-base	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1108474]
Debian	qtbase-opensource-src	source	sid	`5.15.15+dfsg-6`	not yet assigned	Not reported	[1108475]
Debian	qtbase-opensource-src	source	forky	`5.15.15+dfsg-6`	not yet assigned	Not reported	[1108475]
Debian	qtbase-opensource-src	source	trixie	`5.15.15+dfsg-6`	not yet assigned	Not reported	[1108475]
Debian	qtbase-opensource-src	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1108475]
Debian	qtbase-opensource-src-gles	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	qtbase-opensource-src-gles	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	qtbase-opensource-src-gles	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	qtbase-opensource-src-gles	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	libqt5-qtbase	rpm	tumbleweed	`5.15.17+kde122-2.1`	Not reported	OPENSUSE-SU-2025:15240-1	Not reported

[Debian bug #1108474][Debian bug #1108475]

Notes

[bookworm] qt6-base: Minor issue [bookworm] qtbase-opensource-src: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libqt5concurrent5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5core5a]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5dbus5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5gui5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5network5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5opengl5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5opengl5-dev]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5printsupport5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-ibase]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-mysql]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-odbc]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-psql]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-sqlite]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5sql5-tds]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5test5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5widgets5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt5xml5]Affected
Source package: [qtbase-opensource-src]
Details (2)
- 5.15.8+dfsg-11+deb12u3 · amd64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- 5.15.8+dfsg-11+deb12u3 · arm64 · bookworm
  Affected
  dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
[libqt6concurrent6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
[libqt6core6]Affected
Source package: [qt6-base]
Details (2)
- 6.4.2+dfsg-10 · amd64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
- 6.4.2+dfsg-10 · arm64 · bookworm
  Affected
  dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12

Next results

Observed: Oct 24, 2026, 10:03:54 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]