Every CVE Search/ Get API key

CVE-2025-12385

Improper validation of <img> tag size in Text component parser

8.7 HighFix available

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Up 0.3 points since Dec 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.7

Improper validation of <img> tag size in Text component parser

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
CVE-2025-12385
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-1284
Updated
2026-11-02
EUVDEUVD-2025-201103 8.7

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
EUVD-2025-201103
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x9vj-67g7-457m 8.7

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity...

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
GHSA-x9vj-67g7-457m
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770
Updated
2026-11-02
NVD 8.7

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
CVE-2025-12385
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-770, CWE-1284
Updated
2026-11-02
OSVDEBIAN-CVE-2025-12385 8.7

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
DEBIAN-CVE-2025-12385
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-2844 5.0

qt6-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2844
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2025-2845 5.0

qt6-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2845
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2846 5.0

qt6-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2846
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2870 5.0

qt5-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2870
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2871 5.0

qt5-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2871
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2872 5.0

qt5-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2872
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2873 5.0

qt5-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2873
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2874 5.0

qt5-qtdeclarative security update

.

Security Fix(es):

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.(CVE-2025-12385)

Record
OESA-2025-2874
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-12385 8.7

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
UBUNTU-CVE-2025-12385
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-71555 No score

CVE-2025-12385 affecting package qtdeclarative for versions less than 6.6.1-2

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
AZL-71555
Updated
2026-11-05
OSVAZL-71647 No score

CVE-2025-12385 affecting package qt5-qtdeclarative 5.12.5-5

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Record
AZL-71647
Updated
2026-11-02
OSVUSN-8357-1 No score

qtdeclarative-opensource-src vulnerability

It was discovered that Qt Declarative did not properly validate the width and height attributes of image tags in the Text component of Qt Quick. An attacker could possibly use this issue to cause Qt Declarative to use excessive resources, leading to a denial of service.

Record
USN-8357-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qtdeclarative
Azure Linux:3
 before 6.6.1-2
6.6.1-2
qt5-qtdeclarative
Azure Linux:2
 through 5.12.5-5 None known
qt6-declarative
Debian:12
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-5
Show 45 moreShow less
6.10.2+dfsg-66.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-3+sparc646.4.2+dfsg-16.4.2+dfsg-26.4.2+dfsg-36.4.2+dfsg-46.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.2+dfsg-16.6.2+dfsg-26.6.2+dfsg-36.6.2+dfsg-46.6.2+dfsg-4+hurd.16.7.2+dfsg-16.7.2+dfsg-106.7.2+dfsg-10+hurd.16.7.2+dfsg-116.7.2+dfsg-26.7.2+dfsg-36.7.2+dfsg-46.7.2+dfsg-56.7.2+dfsg-66.7.2+dfsg-76.7.2+dfsg-86.7.2+dfsg-96.8.2+dfsg-16.8.2+dfsg-26.8.2+dfsg-36.8.2+dfsg-46.8.2+dfsg-56.8.2+dfsg-66.8.2+dfsg-6+alpha6.8.2+dfsg-6+hurd.16.8.2+dfsg-76.8.2+dfsg-7+m68k6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-1
 None known
qt6-declarative
Debian:13
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-5
Show 15 moreShow less
6.10.2+dfsg-66.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-3+sparc646.8.2+dfsg-76.8.2+dfsg-7+m68k6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-46.9.2+dfsg-56.9.2+dfsg-6
 None known
qt6-declarative
Debian:14
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-5
Show 15 moreShow less
6.10.2+dfsg-66.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-3+sparc646.8.2+dfsg-76.8.2+dfsg-7+m68k6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-46.9.2+dfsg-56.9.2+dfsg-6
 None known
qtdeclarative-opensource-src
Debian:12
 All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-2+m68k5.15.10+dfsg-2+m68k.15.15.11+dfsg-1
Show 23 moreShow less
5.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-2+hurd.15.15.13+dfsg-2+loong645.15.13+dfsg-2+m68k5.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-2+hurd.15.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-2+hurd.15.15.17+dfsg-35.15.17+dfsg-45.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-35.15.9+dfsg-1
 None known
qtdeclarative-opensource-src
Debian:13
 All versions, plus listed versions
5.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-2
Show 7 moreShow less
5.15.17+dfsg-2+hurd.15.15.17+dfsg-35.15.17+dfsg-45.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-2
 None known
qtdeclarative-opensource-src
Debian:14
 before 5.15.17+dfsg-4, plus listed versions
5.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-2+hurd.15.15.17+dfsg-3
5.15.17+dfsg-4
qtdeclarative-opensource-src-gles
Debian:12
 All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.13+dfsg-1
Show 11 moreShow less
5.15.13+dfsg-25.15.13+dfsg-35.15.15+dfsg-15.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-15.15.9+dfsg-1
 None known
qtdeclarative-opensource-src-gles
Debian:13
 All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
 None known
Show 27 moreShow less
Affected packages
PackageAffectedFixed
qtdeclarative-opensource-src-gles
Debian:14
 All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
 None known
qt6-qtdeclarative
openEuler:24.03-LTS-SP2
 before 6.5.2-2.oe2403sp2
6.5.2-2.oe2403sp2
qt6-qtdeclarative
openEuler:24.03-LTS
 before 6.5.2-2.oe2403
6.5.2-2.oe2403
qt6-qtdeclarative
openEuler:24.03-LTS-SP1
 before 6.5.2-2.oe2403sp1
6.5.2-2.oe2403sp1
qt5-qtdeclarative
openEuler:22.03-LTS-SP4
 before 5.15.2-2.oe2203sp4
5.15.2-2.oe2203sp4
qt5-qtdeclarative
openEuler:24.03-LTS
 before 5.15.10-2.oe2403
5.15.10-2.oe2403
qt5-qtdeclarative
openEuler:24.03-LTS-SP1
 before 5.15.10-2.oe2403sp1
5.15.10-2.oe2403sp1
qt5-qtdeclarative
openEuler:24.03-LTS-SP2
 before 5.15.10-2.oe2403sp2
5.15.10-2.oe2403sp2
qt5-qtdeclarative
openEuler:22.03-LTS-SP3
 before 5.15.2-2.oe2203sp3
5.15.2-2.oe2203sp3
qtdeclarative-opensource-src
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2-1ubuntu65.4.2-1ubuntu75.4.2-1ubuntu85.5.1-2ubuntu25.5.1-2ubuntu35.5.1-2ubuntu45.5.1-2ubuntu55.5.1-2ubuntu6
 None known
qtdeclarative-opensource-src-gles
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2-1ubuntu75.4.2-1ubuntu85.5.1-2ubuntu15.5.1-2ubuntu35.5.1-2ubuntu45.5.1-2ubuntu55.5.1-2ubuntu6
 None known
qtdeclarative-opensource-src
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.9.1-4ubuntu15.9.2-3ubuntu25.9.3-0ubuntu15.9.4-0ubuntu15.9.5-0ubuntu15.9.5-0ubuntu1.1
 None known
qtdeclarative-opensource-src
Ubuntu:Pro:20.04:LTS
 before 5.12.8-0ubuntu1+esm1, plus listed versions
5.12.4-15.12.5-35.12.5-55.12.5-5build15.12.8-0ubuntu1
5.12.8-0ubuntu1+esm1
qtdeclarative-opensource-src-gles
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.12.5-25.12.5-2build15.12.8-0ubuntu1
 None known
qt6-declarative
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2+dfsg-4ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-3ubuntu1
 None known
qtdeclarative-opensource-src-gles
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.2+dfsg-35.15.3+dfsg-1
 None known
qtdeclarative-opensource-src
Ubuntu:Pro:22.04:LTS
 before 5.15.3+dfsg-1ubuntu0.1~esm1, plus listed versions
5.15.2+dfsg-85.15.2+dfsg-95.15.2+dfsg-105.15.3+dfsg-1
5.15.3+dfsg-1ubuntu0.1~esm1
qt6-declarative
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2+dfsg-36.4.2+dfsg-46.4.2+dfsg-4build16.4.2+dfsg-4build26.4.2+dfsg-4build3
 None known
qtdeclarative-opensource-src-gles
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10+dfsg-25.15.12+dfsg-15.15.12+dfsg-1build15.15.12+dfsg-1build25.15.13+dfsg-2
 None known
qtdeclarative-opensource-src
Ubuntu:Pro:24.04:LTS
 before 5.15.13+dfsg-1ubuntu0.1+esm1, plus listed versions
5.15.10+dfsg-25.15.12+dfsg-15.15.12+dfsg-1build15.15.12+dfsg-1build25.15.13+dfsg-15.15.13+dfsg-1ubuntu0.1
5.15.13+dfsg-1ubuntu0.1+esm1
qt6-declarative
Ubuntu:25.10
 All versions, plus listed versions
6.8.3+dfsg-0ubuntu16.9.2+dfsg-1
 None known
qtdeclarative-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.15+dfsg-35.15.17+dfsg-1
 None known
qtdeclarative-opensource-src-gles
Ubuntu:25.10
 All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-1
 None known
qt6-declarative
Ubuntu:26.10
 All versions, plus listed versions
6.10.2+dfsg-36.10.2+dfsg-66.11.2+dfsg-2ubuntu1
 None known
qtdeclarative-opensource-src-gles
Ubuntu:26.10
 All versions, plus listed versions
5.15.18+dfsg-15.15.19+dfsg-2
 None known
qt6-declarative
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.9.2+dfsg-16.9.2+dfsg-56.10.2+dfsg-3
 None known
qtdeclarative-opensource-src-gles
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-12385 is a high vulnerability (CVSS 8.7) in Qt, published December 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in qtdeclarative 6.6.1-2.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 5 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open