This vulnerability (CVE-2025-12385) in The Qt Company Qt framework arises from allocation of resources without limits or throttling due to missing validation of width and height attributes in the <img> tag within the Text component of Qt Quick. This improper validation can cause excessive allocation of resources, potentially leading to application unresponsiveness. The affected platforms include Windows, MacOS, Linux, iOS, Android, and various CPU architectures (x86, ARM, 64 bit, 32 bit). The affected Qt versions are from 5.0.0 through 6.5.10, 6.6.0 through 6.8.5, and 6.9.0 through 6.10.0. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, no privileges or user interaction required, and high impact on availability.

Exploitation of this vulnerability can cause applications using the affected Qt Text component to become unresponsive due to excessive resource allocation triggered by malformed or malicious <img> tag width and height attributes. This impacts application availability but does not indicate confidentiality or integrity compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, developers should consider implementing input validation or throttling mechanisms for resource allocation related to image dimensions in the Qt Quick Text component. Monitor Qt's official channels for updates and patches addressing this vulnerability.