CVE-2022-40983
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2....
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
CVE-2022-40983- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2022-44229
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
EUVD-2022-44229- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-32ph-rfjm-xcxh
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2....
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
GHSA-32ph-rfjm-xcxh- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
CVE-2022-40983- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
CVE-2022-40983- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-40983 No score
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Record
DEBIAN-CVE-2022-40983- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-declarativeDebian:12 |
before 6.4.2+dfsg~rc1-2 | 6.4.2+dfsg~rc1-2 |
qt6-declarativeDebian:13 |
before 6.4.2+dfsg~rc1-2 | 6.4.2+dfsg~rc1-2 |
qt6-declarativeDebian:14 |
before 6.4.2+dfsg~rc1-2 | 6.4.2+dfsg~rc1-2 |
qtdeclarative-opensource-srcDebian:12 |
All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-2+m68k5.15.10+dfsg-2+m68k.15.15.11+dfsg-1 Show 23 moreShow less5.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-2+hurd.15.15.13+dfsg-2+loong645.15.13+dfsg-2+m68k5.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-2+hurd.15.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-2+hurd.15.15.17+dfsg-35.15.17+dfsg-45.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-35.15.9+dfsg-1 |
None known |
qtdeclarative-opensource-srcDebian:13 |
All versions, plus listed versions 5.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-2 Show 7 moreShow less5.15.17+dfsg-2+hurd.15.15.17+dfsg-35.15.17+dfsg-45.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-2 |
None known |
qtdeclarative-opensource-srcDebian:14 |
All versions, plus listed versions 5.15.15+dfsg-35.15.15+dfsg-3+m68k5.15.16+dfsg-15.15.17+dfsg-15.15.17+dfsg-2 Show 7 moreShow less5.15.17+dfsg-2+hurd.15.15.17+dfsg-35.15.17+dfsg-45.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-2 |
None known |
qtdeclarative-opensource-src-glesDebian:12 |
All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.13+dfsg-1 Show 11 moreShow less5.15.13+dfsg-25.15.13+dfsg-35.15.15+dfsg-15.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-15.15.9+dfsg-1 |
None known |
qtdeclarative-opensource-src-glesDebian:13 |
All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 |
None known |
qtdeclarative-opensource-src-glesDebian:14 |
All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-40983 is a high vulnerability (CVSS 8.8) in Qt, published January 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in qt6-declarative 6.4.2+dfsg~rc1-2.