CVE-2025-12385: Improper validation of <img> tag size in Text component parser
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.
This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.
This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.
Other sources
Improper validation of <img> tag size in Text component parser
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qtdeclarative-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.17+dfsg-4 - Upgrade
Upgrade
ubuntu/qtdeclarative-opensource-srcto a version that resolves this vulnerability.Fixed in 5.12.8-0ubuntu1+esm1 - Upgrade
Upgrade
ubuntu/qtdeclarative-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.3+dfsg-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/qtdeclarative-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.13+dfsg-1ubuntu0.1+esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12385?
CVE-2025-12385 is considered a medium severity vulnerability due to its potential for excessive resource allocation.
How do I fix CVE-2025-12385?
To fix CVE-2025-12385, users should upgrade their Qt software to a version that addresses the vulnerability, specifically beyond version 6.8.5 or within versions 5.0.0 to 6.5.10.
What types of systems are affected by CVE-2025-12385?
CVE-2025-12385 affects The Qt Company Qt software running on Windows, MacOS, Linux, iOS, and Android across various architectures.
What input does CVE-2025-12385 impact?
CVE-2025-12385 impacts the Text component of Qt, where improper validation of specified quantities may lead to excessive resource allocation.
Is CVE-2025-12385 related to denial of service vulnerabilities?
Yes, due to the potential for excessive resource consumption, CVE-2025-12385 could be leveraged for denial of service attacks.