PT-2025-48986 · Qt Company+1 · Qt+1

Published 2025-10-31 · Updated 2026-06-01 · CVE-2025-12385

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Qt versions 5.0.0 through 6.5.10 Qt versions 6.6.0 through 6.8.5 Qt versions 6.9.0 through 6.10.0

Description A flaw exists in Qt’s Text component that involves improper validation of the width and height specified in the tag. This can lead to excessive resource allocation, potentially causing applications to become unresponsive. The issue impacts users of the Text component across multiple platforms including Windows, MacOS, Linux, iOS, and Android, and affects both 32-bit and 64-bit architectures.

Recommendations Update to a version beyond 6.5.10 Update to a version beyond 6.8.5 Update to a version beyond 6.10.0

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-1284

CWE-770

Related Identifiers

AZL-71555

AZL-71647

BDU:2026-02742

CVE-2025-12385

USN-8357-1

Affected Products

Debian

Qt

References · 24

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12385 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02742 · Security Note
• https://osv.dev/vulnerability/USN-8357-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12385 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12385 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71647 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71555 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12385 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12385 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8357-1 · Vendor Advisory