PT-2025-23897 · Qt Company+1 · Qt+1

Oss Fuzz · Published 2025-06-05 · Updated 2025-10-31 · CVE-2025-5683

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Qt versions 6.3.0 through 6.5.9 Qt versions 6.6.0 through 6.8.4 Qt version 6.9.0

Description The issue occurs when a specifically crafted ICNS format image file is loaded in QImage, triggering a crash.

Recommendations For Qt versions 6.3.0 through 6.5.9, update to version 6.5.10. For Qt versions 6.6.0 through 6.8.4, update to version 6.8.5. For Qt version 6.9.0, update to version 6.9.1.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-06687

CVE-2025-5683

MGASA-2025-0208

OESA-2025-1708

OESA-2025-1709

OESA-2025-1794

OESA-2025-2492

OESA-2025-2493

OESA-2025-2494

OESA-2025-2495

OESA-2025-2496

OESA-2025-2581

Affected Products

Debian

Qt

References · 44

• https://bdu.fstec.ru/vul/2026-06687 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2496 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2581 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5683 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5683 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/D3F6LZUJWFANK7X5A65ECKBPB2KQ2DCO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5683 · Security Note
• https://issues.oss-fuzz.com/issues/415350704 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1709 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2495 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1708 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5683 · Security Note
• https://advisories.mageia.org/MGASA-2025-0208.html · Security Note
• https://osv.dev/vulnerability/OESA-2025-2492 · Vendor Advisory