REDHAT-BUG-2556149: High severity The Qt Company Qt vulnerability

Q: Which applications are exposed to this issue?

Applications using the Qt Quick Text component are affected if they process content containing an <img> tag. The issue applies to Qt versions 5.0.0 through 6.5.10, 6.6.0 through 6.8.5, and 6.9.0 through 6.10.0.

Published Oct 20, 2026

Updated

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.

This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Affected Software

1 affected component

The Qt Company Qt>=5.0.0<=6.5.10, >=6.6.0<=6.8.5, >=6.9.0<=6.10.0

Event History

Oct 20, 2026

Data Sourced

via Red Hat·12:07 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using the Qt Quick Text component are affected if they process content containing an <img> tag. The issue applies to Qt versions 5.0.0 through 6.5.10, 6.6.0 through 6.8.5, and 6.9.0 through 6.10.0.

What must an attacker provide to trigger the problem?

An attacker needs to cause the Qt Quick Text component to process an <img> tag with width or height values that are not properly validated. Those values can lead to excessive resource allocation and make the application unresponsive.

What is the practical impact of successful exploitation?

Successful exploitation can cause excessive allocation of resources, resulting in an affected application becoming unresponsive.

REDHAT-BUG-2556149: High severity The Qt Company Qt vulnerability

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the problem?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the problem?

What is the practical impact of successful exploitation?