RLSA-2026:98531: Important: qt5-qtdeclarative security update
Qt5 - QtDeclarative component.
Security Fix(es):
qt5-qtdeclarative: qt6-qtdeclarative: Improper validation of <img> tag size in Text component parser (CVE-2025-12385)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/qt5-qtdeclarativeto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-develto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-devel-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-examplesto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-examples-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1 - Upgrade
Upgrade
rocky-linux/qt5-qtdeclarative-staticto a version that resolves this vulnerability.Fixed in 0:5.15.9-3.el9_9.1
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that the issue is remotely exploitable with low attack complexity, requires no privileges, and does not require user interaction.
What is the expected security impact?
The reported impact is limited to availability, with high availability impact and no reported confidentiality or integrity impact.
Which installed packages are covered by this advisory?
The advisory covers rocky-linux packages qt5-qtdeclarative, qt5-qtdeclarative-debuginfo, qt5-qtdeclarative-debugsource, qt5-qtdeclarative-devel, qt5-qtdeclarative-devel-debuginfo, qt5-qtdeclarative-examples, qt5-qtdeclarative-examples-debuginfo, and qt5-qtdeclarative-static.