CVE-2021-38593

Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from...

7.5 HighFix available

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.00%Up 1.8 points since Aug 12, 2021

What each source reports

NVD Score used 7.5

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: CVE-2021-38593
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-787
Updated: 2026-11-03

CVE List No score

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: CVE-2021-38593
Updated: 2026-11-02

EUVDEUVD-2021-25035 No score

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: EUVD-2021-25035
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qfcf-2jfw-4cm8 7.5

Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from...

Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: GHSA-qfcf-2jfw-4cm8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-03

OSVAZL-34211 7.5

CVE-2021-38593 affecting package qt5-qtbase for versions less than 5.12.11-11

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: AZL-34211
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-6838 7.5

CVE-2021-38593 affecting package qt5-qtsvg for versions less than 5.12.11-3

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: AZL-6838
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSV 7.5

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: CVE-2021-38593
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-04

OSVOESA-2022-2059 7.5

qt5-qtbase security update

Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.

Security Fix(es):

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).(CVE-2021-38593)

Record: OESA-2022-2059
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2022-2060 7.5

qt5-qtbase security update

Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.

Security Fix(es):

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).(CVE-2021-38593)

Record: OESA-2022-2060
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:1796 7.5

Red Hat Security Advisory: qt5-qtbase security update

Record: RHSA-2022:1796
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2022:1796 7.5

Moderate: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke (CVE-2021-38593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record: RLSA-2022:1796
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-38593 7.5

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

Record: UBUNTU-CVE-2021-38593
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2022:1796 No score

Moderate: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke (CVE-2021-38593)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2022:1796
Updated: 2026-11-02

OSVMGASA-2021-0493 No score

Updated qtbase5 packages fix security vulnerability

It was discovered that Qt incorrectly handled certain XBM image files. If a user or automated system were tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in a denial of service. (CVE-2020-17507)

It was discovered that Qt incorrectly handled certain graphics operations. If a user or automated system were tricked into performing certain graphics operations, a remote attacker could cause Qt to crash, resulting in a denial of service. (CVE-2021-38593)

Record: MGASA-2021-0493
Updated: 2026-11-02

OSVUSN-5081-1 No score

qtbase-opensource-src vulnerabilities

Record: USN-5081-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qt5-qtbase` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-common` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-devel` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-examples` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-gui` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-mysql` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-odbc` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-postgresql` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-private-devel` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8
`qt5-qtbase-static` AlmaLinux:8	before 5.15.2-4.el8	5.15.2-4.el8

Show 44 moreShow less

Affected packages
Package	Affected	Fixed
`qt5-qtbase` Azure Linux:2	before 5.12.11-11	5.12.11-11
`qt5-qtsvg` Azure Linux:2	before 5.12.11-3	5.12.11-3
`qtbase5` Mageia:8 From an advisory covering 2 CVEs	before 5.15.2-4.4.mga8	5.15.2-4.4.mga8
`qt5-qtbase` openEuler:20.03-LTS-SP3	before 5.11.1-13.oe1	5.11.1-13.oe1
`qt5-qtbase` openEuler:22.03-LTS	before 5.15.2-3.oe2203	5.15.2-3.oe2203
`qt5-qtbase` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-common` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-devel` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-examples` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-examples-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-gui` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-gui-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-mysql` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-mysql-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-odbc` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-odbc-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-postgresql` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-postgresql-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-private-devel` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-tests-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-debugsource` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-devel-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-examples-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-gui-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-mysql-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-odbc-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-postgresql-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-static` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase-tests-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qt5-qtbase` Rocky Linux:8	before 0:5.15.2-4.el8	0:5.15.2-4.el8
`qtbase-opensource-src-gles` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less 5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6	None known
`qtbase-opensource-src` Ubuntu:18.04:LTS	before 5.9.5+dfsg-0ubuntu2.6, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 9 moreShow less 5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.5	5.9.5+dfsg-0ubuntu2.6
`qtbase-opensource-src` Ubuntu:20.04:LTS	before 5.12.8+dfsg-0ubuntu2.1, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build15.12.8+dfsg-0ubuntu1	5.12.8+dfsg-0ubuntu2.1
`qtbase-opensource-src-gles` Ubuntu:20.04:LTS	All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1	None known
`qtbase-opensource-src-gles` Ubuntu:22.04:LTS	All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1	None known
`qtbase-opensource-src-gles` Ubuntu:24.04:LTS	All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1	None known
`qtbase-opensource-src-gles` Ubuntu:25.10	All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-1	None known
`qtbase-opensource-src-gles` Ubuntu:26.10	All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2	None known
`qtbase-opensource-src-gles` Ubuntu:26.04:LTS	All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1	None known
`qtbase-opensource-src` Ubuntu:18.04:LTS From an advisory covering 2 CVEs	before 5.9.5+dfsg-0ubuntu2.6, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 9 moreShow less 5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.5	5.9.5+dfsg-0ubuntu2.6

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 4, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 3, 2026	references	GitHub Advisories, NVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38593 is a high vulnerability (CVSS 7.5) in Qt, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in qt5-qtbase 5.15.2-4.el8.

References

Show 25 moreShow less