CVE catalog

CVE-2025-5683

qt6-imageformats: CVE-2025-5683

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash.  This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianqt6-imageformatssid6.11.2-2fixed
Debianqt6-imageformatsforky6.11.2-2fixed
Debianqt6-imageformatstrixie6.8.2-4fixed
Debianqt6-imageformatsbookworm6.4.2-1vulnerable
Debianqtimageformats-opensource-srcsid5.15.19-2fixed
Debianqtimageformats-opensource-srcforky5.15.19-2fixed
Debianqtimageformats-opensource-srctrixie5.15.15-4fixed
Debianqtimageformats-opensource-srcbookworm5.15.8-2vulnerable
Ubuntuqtimageformats-opensource-src16.045.4.2-2build1vulnerable
Ubuntuqtimageformats-opensource-src16.045.5.1-2build1vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.1-1vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.2-1vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.2-2vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.3-1ubuntu1vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.4-0ubuntu1vulnerable
Ubuntuqtimageformats-opensource-src18.045.9.5-0ubuntu1vulnerable
Ubuntuqtimageformats-opensource-src20.045.12.4-1vulnerable
Ubuntuqtimageformats-opensource-src20.045.12.5-1vulnerable
Ubuntuqtimageformats-opensource-src20.045.12.5-1build1vulnerable
Ubuntuqtimageformats-opensource-src20.045.12.8-0ubuntu1vulnerable
Ubuntuqt6-imageformats22.046.2.2-2vulnerable
Ubuntuqt6-imageformats22.046.2.4-1vulnerable
Ubuntuqtimageformats-opensource-src22.045.15.2-2vulnerable
Ubuntuqtimageformats-opensource-src22.045.15.2-2build1vulnerable
Ubuntuqtimageformats-opensource-src22.045.15.3-1vulnerable
Ubuntuqt6-imageformats24.046.4.2-4vulnerable
Ubuntuqt6-imageformats24.046.4.2-5vulnerable
Ubuntuqt6-imageformats24.046.4.2-5build1vulnerable
Ubuntuqt6-imageformats24.046.4.2-5build2vulnerable
Ubuntuqtimageformats-opensource-src24.045.15.10-2vulnerable
Ubuntuqtimageformats-opensource-src24.045.15.12-1vulnerable
Ubuntuqtimageformats-opensource-src24.045.15.12-1build1vulnerable
Ubuntuqtimageformats-opensource-src24.045.15.12-1build2vulnerable
Ubuntuqtimageformats-opensource-src24.045.15.13-1vulnerable
Ubuntuqt6-imageformats25.106.8.3-0ubuntu1vulnerable
Ubuntuqt6-imageformats25.106.9.2-1vulnerable
Ubuntuqtimageformats-opensource-src25.105.15.15-3vulnerable
Ubuntuqtimageformats-opensource-src25.105.15.15-4vulnerable
Ubuntuqtimageformats-opensource-src25.105.15.17-1vulnerable
Ubuntuqt6-imageformats26.106.10.2-1vulnerable
Ubuntuqt6-imageformats26.106.10.2-3vulnerable
Ubuntuqt6-imageformats26.106.11.2-1vulnerable
Ubuntuqtimageformats-opensource-src26.105.15.18-1vulnerable
Ubuntuqtimageformats-opensource-src26.105.15.19-2vulnerable
Ubuntuqt6-imageformats26.046.9.2-1vulnerable
Ubuntuqt6-imageformats26.046.9.2-3vulnerable
Ubuntuqt6-imageformats26.046.10.2-1vulnerable
Ubuntuqtimageformats-opensource-src26.045.15.17-1vulnerable
Ubuntuqtimageformats-opensource-src26.045.15.17-2vulnerable
Ubuntuqtimageformats-opensource-src26.045.15.18-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianqt6-imageformatssourcesid6.8.2-4not yet assignedNot reported[1107317]
Debianqt6-imageformatssourceforky6.8.2-4not yet assignedNot reported[1107317]
Debianqt6-imageformatssourcetrixie6.8.2-4not yet assignedNot reported[1107317]
Debianqt6-imageformatssourcebookworm(unfixed)not yet assignedNot reported[1107317]
Debianqtimageformats-opensource-srcsourcesid5.15.15-4not yet assignedNot reported[1107318]
Debianqtimageformats-opensource-srcsourceforky5.15.15-4not yet assignedNot reported[1107318]
Debianqtimageformats-opensource-srcsourcetrixie5.15.15-4not yet assignedNot reported[1107318]
Debianqtimageformats-opensource-srcsourcebookworm(unfixed)not yet assignedNot reported[1107318]

[Debian bug #1107317][Debian bug #1107318]

Notes

[bookworm] qt6-imageformats: Minor issue [bookworm] qtimageformats-opensource-src: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [qt5-image-formats-plugins]Affected

    Source package: [qtimageformats-opensource-src]

    Details (2)

    • 5.15.8-2 · amd64 · bookworm

      Affected

      dsa · qtimageformats-opensource-src · debian · bookworm; dsa · qtimageformats-opensource-src · debian · 12

    • 5.15.8-2 · arm64 · bookworm

      Affected

      dsa · qtimageformats-opensource-src · debian · bookworm; dsa · qtimageformats-opensource-src · debian · 12

  • [qt6-image-formats-plugins]Affected

    Source package: [qt6-imageformats]

    Details (2)

    • 6.4.2-1 · amd64 · bookworm

      Affected

      dsa · qt6-imageformats · debian · bookworm; dsa · qt6-imageformats · debian · 12

    • 6.4.2-1 · arm64 · bookworm

      Affected

      dsa · qt6-imageformats · debian · bookworm; dsa · qt6-imageformats · debian · 12

[Debian 13 (Trixie)]

  • [qt5-image-formats-plugins]Fixed

    Source package: [qtimageformats-opensource-src]

    Details (2)

    • 5.15.15-4 · amd64 · trixie

      Fixed · Fixed: 5.15.15-4

      dsa · qtimageformats-opensource-src · debian · 13

    • 5.15.15-4 · arm64 · trixie

      Fixed · Fixed: 5.15.15-4

      dsa · qtimageformats-opensource-src · debian · 13

  • [qt6-imageformats-doc]Fixed

    Source package: [qt6-imageformats]

    Details (2)

    • 6.8.2-4 · all · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

    • 6.8.2-4 · all · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

  • [qt6-imageformats-doc-html]Fixed

    Source package: [qt6-imageformats]

    Details (2)

    • 6.8.2-4 · all · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

    • 6.8.2-4 · all · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

  • [qt6-image-formats-plugins]Fixed

    Source package: [qt6-imageformats]

    Details (2)

    • 6.8.2-4 · amd64 · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

    • 6.8.2-4 · arm64 · trixie

      Fixed · Fixed: 6.8.2-4

      dsa · qt6-imageformats · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]