CVE-2025-5455: CWE-20 Improper Input Validation in Qt
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
AI Analysis
Technical Summary
The vulnerability CVE-2025-5455 in Qt arises from improper input validation in the private API function qDecodeDataUrl(). Specifically, when this function processes a malformed data URL with a charset parameter lacking a value (e.g., "data:charset,"), and Qt is compiled with assertions enabled, it triggers an assertion failure that aborts the application, resulting in a denial of service. This affects multiple Qt versions up to 5.15.18, 6.0.0 through 6.5.8, 6.6.0 through 6.8.3, and 6.9.0. The issue has been addressed in subsequent patch releases 5.15.19, 6.5.9, 6.8.4, and 6.9.1.
Potential Impact
Exploitation of this vulnerability causes an application denial of service due to an assertion failure when processing malformed data URLs with a charset parameter missing a value. This can lead to application aborts in software using affected Qt versions, potentially disrupting services or user operations. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available and has been released in Qt versions 5.15.19, 6.5.9, 6.8.4, and 6.9.1. Users and developers should upgrade affected Qt versions to these fixed releases to remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.
CVE-2025-5455: CWE-20 Improper Input Validation in Qt
Description
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
CVSS v4.0
Score 8.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-5455 in Qt arises from improper input validation in the private API function qDecodeDataUrl(). Specifically, when this function processes a malformed data URL with a charset parameter lacking a value (e.g., "data:charset,"), and Qt is compiled with assertions enabled, it triggers an assertion failure that aborts the application, resulting in a denial of service. This affects multiple Qt versions up to 5.15.18, 6.0.0 through 6.5.8, 6.6.0 through 6.8.3, and 6.9.0. The issue has been addressed in subsequent patch releases 5.15.19, 6.5.9, 6.8.4, and 6.9.1.
Potential Impact
Exploitation of this vulnerability causes an application denial of service due to an assertion failure when processing malformed data URLs with a charset parameter missing a value. This can lead to application aborts in software using affected Qt versions, potentially disrupting services or user operations. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available and has been released in Qt versions 5.15.19, 6.5.9, 6.8.4, and 6.9.1. Users and developers should upgrade affected Qt versions to these fixed releases to remediate the vulnerability. No additional mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- TQtC
- Date Reserved
- 2025-06-02T08:31:36.081Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 683d67c1182aa0cae23c2b24
Added to database: 06/02/2025, 08:58:41 UTC
Last enriched: 07/29/2026, 21:36:56 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 139
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.