{"id":"CVE-2021-28025","aliases":["DEBIAN-CVE-2021-28025","EUVD-2021-14743","GHSA-3w9r-2mqj-cf5c","UBUNTU-CVE-2021-28025","USN-8337-1"],"status":"published","title":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and...","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00288,"percentile":0.21571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2023-08-11T00:00:00Z","modified":"2026-10-24T10:31:06Z","fixes":[{"ecosystem":"Debian:12","package":"qtsvg-opensource-src","fixed_in":["5.15.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtsvg-opensource-src","fixed_in":["5.15.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtsvg-opensource-src","fixed_in":["5.15.4-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtsvg-opensource-src","fixed_in":["5.5.1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtsvg-opensource-src","fixed_in":["5.12.8-0ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4","4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.6+git64-g5dc8b2b+dfsg-3~ubuntu8","4:4.8.7+dfsg-5ubuntu1","4:4.8.7+dfsg-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-2ubuntu0.1~esm1"}]}],"versions":["5.4.2-2build1","5.5.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.7+dfsg-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.8-0ubuntu1+esm1"}]}],"versions":["5.12.4-1","5.12.5-2","5.12.5-2build1","5.12.8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-2ubuntu1","6.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-4ubuntu1","6.4.2-4ubuntu2","6.4.2-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.3-0ubuntu1","6.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-2","6.10.2-8ubuntu1","6.10.2-9","6.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-4","6.9.2-5","6.10.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-2ubuntu0.1~esm1"}]}],"versions":["5.4.2-2build1","5.5.1-2build1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-0ubuntu1.1+esm1"}]}],"versions":["5.9.1-2","5.9.2-2","5.9.2-3","5.9.3-0ubuntu1","5.9.4-0ubuntu1","5.9.5-0ubuntu1","5.9.5-0ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.8-0ubuntu1+esm1"}]}],"versions":["5.12.4-1","5.12.5-2","5.12.5-2build1","5.12.8-0ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1ubuntu0.1~esm1"}]}],"versions":["5.15.2-3","5.15.2-4","5.15.3-1"],"bundled":5}],"products":[{"vendor":"qt","product":"qt"}],"references":[{"url":"https://bugreports.qt.io/browse/QTBUG-91507","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28025"},{"url":"https://github.com/advisories/GHSA-3w9r-2mqj-cf5c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28025","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28025","tags":["report"]},{"url":"https://code.qt.io/cgit/qt/qtsvg.git/commit/?id=7bbf88403fd2d1fe79fab7c8e469f8aeafeb7372","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28025","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8337-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-19869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32573","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-28025","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T17:37:40.75Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14743","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T17:37:40Z","updated_at":"2026-11-03T00:27:42.985312Z"}],"ghsa":[{"id":"GHSA-3w9r-2mqj-cf5c","title":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and...","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T15:30:46Z","modified":"2024-04-04T06:53:22Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:56:46.449942Z"}],"nvd":[{"id":"CVE-2021-28025","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T14:15:12.453Z","modified":"2026-06-17T03:45:44.227Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-28025","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T14:15:12.453Z","modified":"2026-10-24T10:31:06.105134949Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28025","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T14:15:12.453Z","modified":"2026-10-23T18:03:37.014733511Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28025","description":"Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).","status":"published","published":"2023-08-11T14:15:00Z","modified":"2026-10-17T12:56:15.0319915Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"USN-8337-1","title":"qtsvg-opensource-src vulnerabilities","description":"It was discovered that QtSvg incorrectly handled certain SVG images. An\nattacker could possibly use this issue to cause QtSvg to crash, resulting in\na denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2018-19869)\n\nIt was discovered that QtSvg incorrectly handled certain SVG images. An\nattacker could use this issue to cause QtSvg to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3481,\nCVE-2021-28025, CVE-2021-45930)\n\nIt was discovered that QtSvg incorrectly handled certain SVG images. An\nattacker could use this issue to cause QtSvg to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2023-32573)","status":"published","published":"2026-05-28T14:32:26Z","modified":"2026-05-28T17:32:47.664128662Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}