CVE-2025-5455CWE-20

Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

High · published June 2, 2025

CVSS v4.0
8.4
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

If the function was called with malformed data, for example, an URL that

contained a "charset" parameter that lacked a value (such as

"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service

(abort).

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/R:U/RE:M/U:Clear
EPSS
0.00383 · 31.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-06-02T08:46Z
EPSS history
Timeline
  • 02 JUN 08:46Z
    Possible denial of service when passing malformed data in a URL to qDecodeDataUrl
    cvelistv5