CVE-2022-25255
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could...
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
CVE-2022-25255- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
CVE-2022-25255- Updated
- 2026-11-02
EUVDEUVD-2022-29952 No score
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
EUVD-2022-29952- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw78-qp2x-5gc7 No score
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could...
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
GHSA-fw78-qp2x-5gc7- Updated
- 2026-11-02
OSVAZL-50050
CVE-2022-25255 affecting package qt5-qtbase for versions less than 5.12.11-14
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
AZL-50050- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
CVE-2022-25255- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVDEBIAN-CVE-2022-25255
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
DEBIAN-CVE-2022-25255- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVOESA-2022-1787
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.(CVE-2022-25255)
- Record
OESA-2022-1787- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2022-1803
qt5-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.(CVE-2022-25255)
- Record
OESA-2022-1803- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:7482
Red Hat Security Advisory: qt5 security, bug fix, and enhancement update
- Record
RHSA-2022:7482- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:8022
Red Hat Security Advisory: qt5 security and bug fix update
- Record
RHSA-2022:8022- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2022:7482
Moderate: qt5 security, bug fix, and enhancement update
The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.
The following packages have been upgraded to a later upstream version: qt5 (5.15.3). (BZ#2061377)
Security Fix(es):
- qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.
- Record
RLSA-2022:7482- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2022:8022
Moderate: qt5 security and bug fix update
The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.
Security Fix(es):
- qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.
- Record
RLSA-2022:8022- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-25255
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- Record
UBUNTU-CVE-2022-25255- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2022:7482 No score
Moderate: qt5 security, bug fix, and enhancement update
The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.
The following packages have been upgraded to a later upstream version: qt5 (5.15.3). (BZ#2061377)
Security Fix(es):
- qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:7482- Updated
- 2026-11-05
OSVALSA-2022:8022 No score
Moderate: qt5 security and bug fix update
The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.
Security Fix(es):
- qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:8022- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0841-1 No score
Security update for libqt5-qtbase
This update for libqt5-qtbase fixes the following issues:
- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD (bsc#1195386, bsc#1196501).
- Record
openSUSE-SU-2022:0841-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11879-1 No score
libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-4.1 on GA media
These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11879-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11886-1 No score
libQt6Concurrent6-6.2.3-2.1 on GA media
These are all security issues fixed in the libQt6Concurrent6-6.2.3-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11886-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11974-1 No score
qutebrowser-2.5.0-1.1 on GA media
These are all security issues fixed in the qutebrowser-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11974-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0841-1 No score
Security update for libqt5-qtbase
This update for libqt5-qtbase fixes the following issues:
- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD (bsc#1195386, bsc#1196501).
- Record
SUSE-SU-2022:0841-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt5-develAlmaLinux:8 |
before 5.15.3-1.el8 | 5.15.3-1.el8 |
qt5-rpm-macrosAlmaLinux:8 |
before 5.15.3-1.el8 | 5.15.3-1.el8 |
qt5-srpm-macrosAlmaLinux:8 |
before 5.15.3-1.el8 | 5.15.3-1.el8 |
qt5AlmaLinux:9 |
before 5.15.3-1.el9 | 5.15.3-1.el9 |
qt5-develAlmaLinux:9 |
before 5.15.3-1.el9 | 5.15.3-1.el9 |
qt5-rpm-macrosAlmaLinux:9 |
before 5.15.3-1.el9 | 5.15.3-1.el9 |
qt5-srpm-macrosAlmaLinux:9 |
before 5.15.3-1.el9 | 5.15.3-1.el9 |
qt5-qtbaseAzure Linux:2 |
before 5.12.11-14 | 5.12.11-14 |
qt6-baseDebian:12 |
before 6.2.4+dfsg-4 | 6.2.4+dfsg-4 |
qt6-baseDebian:13 |
before 6.2.4+dfsg-4 | 6.2.4+dfsg-4 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt6-baseDebian:14 |
before 6.2.4+dfsg-4 | 6.2.4+dfsg-4 |
qtbase-opensource-srcDebian:12 |
before 5.15.2+dfsg-15 | 5.15.2+dfsg-15 |
qtbase-opensource-srcDebian:13 |
before 5.15.2+dfsg-15 | 5.15.2+dfsg-15 |
qtbase-opensource-srcDebian:14 |
before 5.15.2+dfsg-15 | 5.15.2+dfsg-15 |
qtbase-opensource-src-glesDebian:12 |
before 5.15.4+dfsg-2 | 5.15.4+dfsg-2 |
qtbase-opensource-src-glesDebian:13 |
before 5.15.4+dfsg-2 | 5.15.4+dfsg-2 |
qtbase-opensource-src-glesDebian:14 |
before 5.15.4+dfsg-2 | 5.15.4+dfsg-2 |
qt5-qtbaseopenEuler:20.03-LTS-SP1 |
before 5.11.1-13.oe1 | 5.11.1-13.oe1 |
qt5-qtbaseopenEuler:20.03-LTS-SP3 |
before 5.11.1-13.oe1 | 5.11.1-13.oe1 |
qt5-qtbaseopenEuler:22.03-LTS |
before 5.15.2-3.oe2203 | 5.15.2-3.oe2203 |
qt5Red Hat:enterprise_linux:8::appstream |
before 0:5.15.3-1.el8 | 0:5.15.3-1.el8 |
qt5-rpm-macrosRed Hat:enterprise_linux:8::appstream |
before 0:5.15.3-1.el8 | 0:5.15.3-1.el8 |
qt5-srpm-macrosRed Hat:enterprise_linux:8::appstream |
before 0:5.15.3-1.el8 | 0:5.15.3-1.el8 |
qt5-develRed Hat:enterprise_linux:8::crb |
before 0:5.15.3-1.el8 | 0:5.15.3-1.el8 |
qt5Red Hat:enterprise_linux:9::appstream |
before 0:5.15.3-1.el9 | 0:5.15.3-1.el9 |
qt5-rpm-macrosRed Hat:enterprise_linux:9::appstream |
before 0:5.15.3-1.el9 | 0:5.15.3-1.el9 |
qt5-srpm-macrosRed Hat:enterprise_linux:9::appstream |
before 0:5.15.3-1.el9 | 0:5.15.3-1.el9 |
qt5-develRed Hat:enterprise_linux:9::crb |
before 0:5.15.3-1.el9 | 0:5.15.3-1.el9 |
qt5Rocky Linux:8 |
before 0:5.15.3-1.el8 | 0:5.15.3-1.el8 |
qt5Rocky Linux:9 |
before 0:5.15.3-1.el9 | 0:5.15.3-1.el9 |
libqt5-qtbaseSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Proxy 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Retail Branch Server 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Server 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
qtbase-opensource-srcUbuntu:Pro:20.04:LTS |
before 5.12.8+dfsg-0ubuntu2.1+esm3, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 4 moreShow less5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm2 |
5.12.8+dfsg-0ubuntu2.1+esm3 |
qt6-baseUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1 |
None known |
qt6-baseUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5 |
None known |
qt6-baseUbuntu:25.10 |
All versions, plus listed versions 6.8.3+dfsg-0ubuntu26.8.3+dfsg-0ubuntu36.9.2+dfsg-1ubuntu1 |
None known |
qt6-baseUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2 |
None known |
qt6-baseUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7 |
None known |
libqt5-qtbaseopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseopenSUSE:Tumbleweed |
before 5.15.2+kde294-4.1 | 5.15.2+kde294-4.1 |
qt6-baseopenSUSE:Tumbleweed |
before 6.2.3-2.1 | 6.2.3-2.1 |
qutebrowseropenSUSE:Tumbleweed |
before 2.5.0-1.1 | 2.5.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25255 is a high vulnerability (CVSS 7.8) in Qt, published February 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in qt5-devel 5.15.3-1.el8.
References
codereview.qt-project.org/c/qt/qtbase/+/393113
download.qt.io/official_releases/qt/6.2/qprocess6-2.diff
nvd.nist.gov/vuln/detail/CVE-2022-25255
Show 30 moreShow less
github.com/advisories/GHSA-fw78-qp2x-5gc7
access.redhat.com/errata/RHSA-2022:7482
bugzilla.redhat.com/2055505
errata.almalinux.org/8/ALSA-2022-7482.html
security-tracker.debian.org/tracker/CVE-2022-25255
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1787
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7482.json
cve.org/CVERecord?id=CVE-2022-25255
errata.rockylinux.org/RLSA-2022:7482
suse.com/support/update/announcement/2022/suse-su-20220841-1
bugzilla.suse.com/1195386
ubuntu.com/security/CVE-2022-25255
lists.opensuse.org/archives/list/[email protected]/thread/NIPE5FF5VKMSL2BZDJ46HDRCTHGR7IUG