CVE-2021-3481: High severity Qt QT vulnerability
A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics (SVG) file this flaw may lead to an unauthorized memory access. The highest threat from this vulnerability is to data confidentiality and the application availability.
Other sources
An out-of-bounds (OOB) memory access flaw was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelperp.h in Qt. While processing a crafted svg input file, parsed doubles to float representable values, and this may lead to an unauthorised memory access problem, and may even lead to a denial-of-service.
References:
https://bugreports.qt.io/browse/QTBUG-91507
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3481?
CVE-2021-3481 is a vulnerability found in Qt, specifically in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h.
What is the severity of CVE-2021-3481?
The severity of CVE-2021-3481 is high with a CVSS score of 7.1.
How does CVE-2021-3481 occur?
CVE-2021-3481 occurs due to an out-of-bounds read vulnerability while rendering and displaying a crafted SVG file.
Which versions of Qt are affected by CVE-2021-3481?
Versions 5.15.1, 6.0.0, 6.0.2, and 6.2.0 of Qt are affected by CVE-2021-3481.
How can I fix CVE-2021-3481?
To fix CVE-2021-3481, update to version 5.12.11 or later for Qt 5 or version 6.0.3 or later for Qt 6.