Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
qtbase may crash on malformed data URLs
published 1 year ago
Summary
The Qt library component qtbase can stop working if it receives a badly formed data URL, such as one missing a charset value. This can cause the application to abort, leading to a temporary loss of service. Upgrade to the latest Qt releases (Qt 5.15.19, Qt 6.5.9, Qt 6.8.4, or Qt 6.9.1) to prevent the issue.
What to do
- Update azure qtbase to version 6.6.3-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | qtbase |
< 6.6.3-4 Fix: upgrade to 6.6.3-4
|
Original advisory text
CVE-2025-5455 affecting package qtbase for versions less than 6.6.3-4
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.
If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).
This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).
This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
References
Timeline
Published2 Jun 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-64349 · OSV
Track software like this
Free during beta