CVE-2023-24607: High severity Qt QT vulnerability

Q: What is the vulnerability ID for this Qt vulnerability?

The vulnerability ID for this Qt vulnerability is CVE-2023-24607.

Q: What is the severity of CVE-2023-24607?

The severity of CVE-2023-24607 is high with a CVSS score of 7.5.

Q: How does CVE-2023-24607 result in a denial of service?

CVE-2023-24607 results in a denial of service by exploiting a crafted string when the SQL ODBC driver plugin is used.

Q: Which versions of Qt are affected by CVE-2023-24607?

Versions 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3 of Qt are affected by CVE-2023-24607.

Q: Are there any fixes available for CVE-2023-24607?

Yes, the fix for CVE-2023-24607 is available in Qt version 6.4.3.

Published Apr 15, 2023

Updated

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.

Affected Software

3 affected components

Qt QT>=5.0.0<5.15.13

Qt QT>=6.0.0<6.2.8

Qt QT>=6.3.0<6.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Qt 5.x to a version that resolves this vulnerability.
Fixed in 5.15.13
Upgrade
Upgrade Qt 6.x to a version that resolves this vulnerability.
Fixed in 6.2.8
Upgrade
Upgrade Qt 6.3.x to a version that resolves this vulnerability.
Fixed in 6.4.3

Event History

Apr 15, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Jan 30, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7259318

Frequently Asked Questions

What is the vulnerability ID for this Qt vulnerability?

The vulnerability ID for this Qt vulnerability is CVE-2023-24607.

What is the severity of CVE-2023-24607?