RHSA-2026:96075: Important: qt5-qtdeclarative security update
Qt5 - QtDeclarative component.Security Fix(es): qt5-qtdeclarative: qt6-qtdeclarative: Improper validation of <img> tag size in Text component parser (CVE-2025-12385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qt5-qtdeclarativeto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-debugsourceto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-develto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-devel-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-examplesto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-examples-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-tests-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarativeto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-debugsourceto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-develto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-devel-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-examplesto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-examples-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-tests-debuginfoto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa - Upgrade
Upgrade
redhat/qt5-qtdeclarative-staticto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10 - Upgrade
Upgrade
redhat/qt5-qtdeclarative-staticto a version that resolves this vulnerability.Fixed in 5.15.3-3.el8_10.aa
Event History
Frequently Asked Questions
Which installed package variants should be considered when assessing exposure?
The advisory lists qt5-qtdeclarative and its debuginfo, debugsource, devel, devel-debuginfo, examples, examples-debuginfo, and tests-debuginfo package variants.
Does the advisory identify Qt 6 packages as affected?
The security-fix description references qt6-qtdeclarative, but the software list for this advisory contains only Red Hat qt5-qtdeclarative package variants.