CVE-2024-30161
In Qt before 6.5.6 and 6.6.x before 6.6.3, the wasm component may access QNetworkReply header...
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
CVE-2024-30161- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2024-28097
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
EUVD-2024-28097- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5gxc-5wfv-r5f9
In Qt before 6.5.6 and 6.6.x before 6.6.3, the wasm component may access QNetworkReply header...
In Qt before 6.5.6 and 6.6.x before 6.6.3, the wasm component may access QNetworkReply header data via a dangling pointer.
- Record
GHSA-5gxc-5wfv-r5f9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
CVE-2024-30161- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
CVE-2024-30161- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-30161
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
UBUNTU-CVE-2024-30161- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVAZL-38545 No score
CVE-2024-30161 affecting package qtbase for versions less than 6.6.3-2
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
- Record
AZL-38545- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13844-1 No score
libQt6Concurrent6-6.7.0-1.1 on GA media
These are all security issues fixed in the libQt6Concurrent6-6.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13844-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1174-1 No score
Security update for qt6-base
This update for qt6-base fixes the following issues:
- CVE-2024-30161: Fixed QNetworkReply header data access via a dangling pointer (bsc#1221926).
- Record
SUSE-SU-2024:1174-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qtbaseAzure Linux:3 |
before 6.6.3-2 | 6.6.3-2 |
qt6-baseSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 6.4.2-150500.3.17.1 | 6.4.2-150500.3.17.1 |
qt6-baseSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 6.4.2-150500.3.17.1 | 6.4.2-150500.3.17.1 |
qt6-baseopenSUSE:Leap 15.5 |
before 6.4.2-150500.3.17.1 | 6.4.2-150500.3.17.1 |
qt6-base-docsopenSUSE:Leap 15.5 |
before 6.4.2-150500.3.17.1 | 6.4.2-150500.3.17.1 |
qtbase-opensource-src-glesUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6 |
None known |
qtbase-opensource-src-glesUbuntu:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1 |
None known |
qt6-baseUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1 |
None known |
qtbase-opensource-src-glesUbuntu:22.04:LTS |
All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1 |
None known |
qt6-baseUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5 |
None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtbase-opensource-src-glesUbuntu:24.04:LTS |
All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1 |
None known |
qt6-baseUbuntu:25.10 |
All versions, plus listed versions 6.8.3+dfsg-0ubuntu26.8.3+dfsg-0ubuntu36.9.2+dfsg-1ubuntu1 |
None known |
qtbase-opensource-src-glesUbuntu:25.10 |
All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-1 |
None known |
qt6-baseUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2 |
None known |
qtbase-opensource-src-glesUbuntu:26.10 |
All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2 |
None known |
qt6-baseUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7 |
None known |
qtbase-opensource-src-glesUbuntu:26.04:LTS |
All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1 |
None known |
qt6-baseopenSUSE:Tumbleweed |
before 6.7.0-1.1 | 6.7.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-30161 is a medium vulnerability (CVSS 6.5) in Qt, published March 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in qtbase 6.6.3-2.