RHSA-2026:98531: Important: qt5-qtdeclarative security update

Q: Which installed packages are covered by this update?

The advisory covers redhat/qt5-qtdeclarative and its debuginfo, debugsource, devel, examples, examples-debuginfo, and tests-debuginfo packages.

Q: What component and input handling are involved in the flaw?

The issue is in the Text component parser's validation of img tag size. The advisory identifies it as improper validation affecting qt5-qtdeclarative and qt6-qtdeclarative.

Q: Where can I find impact and severity details not included in this advisory summary?

The advisory directs readers to the referenced CVE information for impact, CVSS score, acknowledgments, and related details. The listed references also include the Red Hat bug record and errata page.

Published Nov 11, 2026

Updated

Qt5 - QtDeclarative component.Security Fix(es): qt5-qtdeclarative: qt6-qtdeclarative: Improper validation of <img> tag size in Text component parser (CVE-2025-12385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

36 affected componentsFixes available

redhat/qt5-qtdeclarative<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debugsource<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debugsource<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-tests-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-tests-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-debugsource<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-devel-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-examples-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-tests-debuginfo<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-debuginfo<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-debugsource<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-devel<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-devel-debuginfo<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-examples<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-examples-debuginfo<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-tests-debuginfo<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

redhat/qt5-qtdeclarative-static<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-static<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-static<5.15.9-3.el9_9.1

5.15.9-3.el9_9.1

redhat/qt5-qtdeclarative-static<5.15.9-3.el9_9.1.aa

5.15.9-3.el9_9.1.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/qt5-qtdeclarative to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-debugsource to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-devel to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-devel-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-examples to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-examples-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-tests-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-debugsource to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-devel to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-devel-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-examples to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-examples-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-tests-debuginfo to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa
Upgrade
Upgrade redhat/qt5-qtdeclarative-static to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1
Upgrade
Upgrade redhat/qt5-qtdeclarative-static to a version that resolves this vulnerability.
Fixed in 5.15.9-3.el9_9.1.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which installed packages are covered by this update?

The advisory covers redhat/qt5-qtdeclarative and its debuginfo, debugsource, devel, examples, examples-debuginfo, and tests-debuginfo packages.

What component and input handling are involved in the flaw?

The issue is in the Text component parser's validation of img tag size. The advisory identifies it as improper validation affecting qt5-qtdeclarative and qt6-qtdeclarative.

Where can I find impact and severity details not included in this advisory summary?

The advisory directs readers to the referenced CVE information for impact, CVSS score, acknowledgments, and related details. The listed references also include the Red Hat bug record and errata page.

RHSA-2026:98531: Important: qt5-qtdeclarative security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installed packages are covered by this update?

What component and input handling are involved in the flaw?

Where can I find impact and severity details not included in this advisory summary?

Company

Resources

Contact

Frequently Asked Questions

Which installed packages are covered by this update?

What component and input handling are involved in the flaw?

Where can I find impact and severity details not included in this advisory summary?