CVE-2025-12385CWE-1284CWE-770denial-of-service

CVE-2025-12385

published December 4, 2025

CVSS
8.7
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weaknesses
CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-12-04T01:16Z
References (2)
https://codereview.qt-project.org/c/qt/qtdeclarative/+/687239 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtdeclarative/+/687766 · a59d8014-47c4-4630-ab43-e1b13cbe58e3
EPSS history
Timeline
  • 03 DEC 19:38Z
    Improper validation of <img> tag size in Text component parser
    cvelistv5