CVE-2004-0691

Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3...

7.5 HighPublic exploitFix available

Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.

Exploit likelihood

14.7%Down 20.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2004-0691
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-0691
Updated: 2026-11-02

EUVDEUVD-2004-0690 No score

Record: EUVD-2004-0690
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4wm5-p9jm-9qvv No score

Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3...

Record: GHSA-4wm5-p9jm-9qvv
Updated: 2026-11-02

Affected products

trolltech qt

Affected packages

Affected packages
Package	Affected	Fixed
`qt-copy` Debian:3.0	before 3.0.3-20020329-1woody2	3.0.3-20020329-1woody2
`qt` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-MySQL` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-ODBC` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-config` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-debuginfo` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-designer` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-devel` Red Hat:enterprise_linux:3::as	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-MySQL` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4

Show 19 moreShow less

Affected packages
Package	Affected	Fixed
`qt-ODBC` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-config` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-debuginfo` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-designer` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-devel` Red Hat:enterprise_linux:3::desktop	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-MySQL` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-ODBC` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-config` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-debuginfo` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-designer` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-devel` Red Hat:enterprise_linux:3::es	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-MySQL` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-ODBC` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-config` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-debuginfo` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-designer` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4
`qt-devel` Red Hat:enterprise_linux:3::ws	before 1:3.1.2-13.4	1:3.1.2-13.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Qt - '.bmp' Parsing Bug Heap Overflow	2004-08-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0691 is a high vulnerability (CVSS 7.5) in Trolltech Qt, published August 25, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.7%, the 96th percentile. Fixed in qt-copy 3.0.3-20020329-1woody2.

References

Show 22 moreShow less