Every CVE Search/ Get API key

CVE-2025-30348

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and...

5.8 MediumFix available

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.37%Up 0.3 points since Mar 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
CVE-2025-30348
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-02
EUVDEUVD-2025-7261 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
EUVD-2025-7261
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-hc3c-6xqp-r265 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and...

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
GHSA-hc3c-6xqp-r265
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-02
NVD 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
CVE-2025-30348
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-02
OSVAZL-58948 5.3

CVE-2025-30348 affecting package qt5-qtbase for versions less than 5.12.11-16

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
AZL-58948
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-58958 5.3

CVE-2025-30348 affecting package qtbase for versions less than 6.6.3-3

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
AZL-58958
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-05
Show 11 moreShow less
OSV 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
CVE-2025-30348
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-02
OSVDEBIAN-CVE-2025-30348 5.3

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
DEBIAN-CVE-2025-30348
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1384 5.3

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1384
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1385 5.3

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1385
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1386 5.3

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1386
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1387 5.3

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1387
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1493 5.3

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1493
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1494 5.3

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)

Record
OESA-2025-1494
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-30348 5.8

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Record
UBUNTU-CVE-2025-30348
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-06
OSVSUSE-SU-2025:03599-1 No score

Security update for qt6-base

This update for qt6-base fixes the following issues:

  • CVE-2025-5455: processing of malformed data in qDecodeDataUrl() can trigger assertion and cause a crash (bsc#1243958).
  • CVE-2025-30348: complex algorithm used in encodeText in QDom when processing XML data can cause low performance (bsc#1239896).
Record
SUSE-SU-2025:03599-1
Updated
2026-11-02
OSVSUSE-SU-2025:3723-1 No score

Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues:

Security issues fixed:

  • CVE-2025-5455: processing of malformed data in qDecodeDataUrl() can trigger assertion and cause a crash (bsc#1243958).
  • CVE-2025-30348: complex algorithm used in encodeText in QDom when processing XML data can cause low performance (bsc#1239896).

Other issues fixed:

  • Initialize a member variable in QObjectPrivate::Signal that was uninitialized under some circumstances.
  • Fix a crash when parsing a particular glyph in a particular font.
  • Avoid repeatedly registering xsettings callbacks when switching cursor themes.
  • Check validity of RandR output info before using it.
  • Fix reparenting a window so it takes effect even if there are no other state changes to the window.
Record
SUSE-SU-2025:3723-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtbase
Azure Linux:2
 before 5.12.11-16
5.12.11-16
qtbase
Azure Linux:3
 before 6.6.3-3
6.6.3-3
qt6-base
Debian:12
 All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12
Show 45 moreShow less
6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.1+dfsg-46.6.1+dfsg-56.6.1+dfsg-66.6.2+dfsg-1
 None known
qt6-base
Debian:13
 before 6.8.2+dfsg-5
6.8.2+dfsg-5
qt6-base
Debian:14
 before 6.8.2+dfsg-5
6.8.2+dfsg-5
qt5-qtbase
openEuler:22.03-LTS-SP3
 before 5.15.2-17.oe2203sp3
5.15.2-17.oe2203sp3
qt5-qtbase
openEuler:22.03-LTS-SP4
 before 5.15.2-17.oe2203sp4
5.15.2-17.oe2203sp4
qt5-qtbase
openEuler:24.03-LTS
 before 5.15.10-11.oe2403
5.15.10-11.oe2403
qt5-qtbase
openEuler:24.03-LTS-SP1
 before 5.15.10-11.oe2403sp1
5.15.10-11.oe2403sp1
qt6-qtbase
openEuler:24.03-LTS
 before 6.5.2-10.oe2403
6.5.2-10.oe2403
Show 33 moreShow less
Affected packages
PackageAffectedFixed
qt6-qtbase
openEuler:24.03-LTS-SP1
 before 6.5.2-10.oe2403sp1
6.5.2-10.oe2403sp1
qt6-base
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base-docs
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base-docs
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
qt6-base-docs
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 6.6.3-150600.3.6.1
6.6.3-150600.3.6.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 2 CVEs
 before 5.15.12+kde151-150600.3.9.1
5.15.12+kde151-150600.3.9.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 5.15.12+kde151-150600.3.9.1
5.15.12+kde151-150600.3.9.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 2 CVEs
 before 5.15.12+kde151-150600.3.9.1
5.15.12+kde151-150600.3.9.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 2 CVEs
 before 5.15.12+kde151-150600.3.9.1
5.15.12+kde151-150600.3.9.1
libqt5-qtbase
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 5.15.12+kde151-150600.3.9.1
5.15.12+kde151-150600.3.9.1
qtbase-opensource-src
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2
Show 15 moreShow less
5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2
 None known
qtbase-opensource-src-gles
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2
Show 9 moreShow less
5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6
 None known
qtbase-opensource-src
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3
Show 12 moreShow less
5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2
 None known
qtbase-opensource-src
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1
Show 6 moreShow less
5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4
 None known
qtbase-opensource-src-gles
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1
 None known
qt6-base
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1
 None known
qtbase-opensource-src
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3
Show 5 moreShow less
5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.2
 None known
qtbase-opensource-src-gles
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1
 None known
qtbase-opensource-src
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3
Show 8 moreShow less
5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3
 None known
qt6-base
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5
 None known
qtbase-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu15.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu1
 None known
qtbase-opensource-src-gles
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1
 None known
qtbase-opensource-src
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1
Show 4 moreShow less
5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1
 None known
qtbase-opensource-src
Ubuntu:25.10
 All versions, plus listed versions
5.15.15+dfsg-4ubuntu15.15.15+dfsg-5ubuntu15.15.17+dfsg-1ubuntu1
 None known
qtbase-opensource-src-gles
Ubuntu:25.10
 All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-1
 None known
qtbase-opensource-src
Ubuntu:26.10
 All versions, plus listed versions
5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2
 None known
qtbase-opensource-src-gles
Ubuntu:26.10
 All versions, plus listed versions
5.15.18+dfsg-15.15.19+dfsg-2
 None known
qtbase-opensource-src
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1
 None known
qtbase-opensource-src-gles
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1
 None known

History

History
RecordedChangedSources
affectedOSV
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30348 is a medium vulnerability (CVSS 5.8) in Qt, published March 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in qt5-qtbase 5.12.11-16.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: 39 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open