PT-2025-12403 · Qt Company+4 · Qt+4

Published 2025-03-21 · Updated 2025-12-15 · CVE-2025-30348

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Qt versions prior to 6.8.0

Description The issue involves a complex algorithm in QDom that includes copying an XML string and replacing parts of a string inline, which also involves relocating later data.

Recommendations For Qt versions prior to 6.8.0, update to version 6.8.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-407

Related Identifiers

ALT-PU-2025-12273

AZL-58948

AZL-58958

BDU:2025-16090

CVE-2025-30348

OESA-2025-1384

OESA-2025-1385

OESA-2025-1386

OESA-2025-1387

OESA-2025-1493

OESA-2025-1494

SUSE-SU-2025:03599-1

SUSE-SU-2025:3723-1

SUSE-SU-2025_03599-1

SUSE-SU-2025_3723-1

Affected Products

Alt Linux

Debian

Qt

Red Os

Suse

References · 39

• https://codereview.qt-project.org/c/qt/qtbase/+/581442 · Patch
• https://ubuntu.com/security/CVE-2025-30348 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-58948 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1386 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30348 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1494 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3723-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30348 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-30348 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-58958 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16090 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03599-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30348 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30348 · Vendor Advisory