Executive brief
A vulnerability exists in the Qt framework, a widely used tool for building cross-platform software interfaces. An attacker could provide specially crafted text containing image tags with extreme dimensions, causing the application to freeze or crash. This results in a denial-of-service, preventing users from accessing the software's functionality.
Technical details
An 'Allocation of Resources Without Limits or Throttling' vulnerability exists in the Qt Quick Text component. The root cause is improper validation of the 'width' and 'height' attributes within the HTML-style <img> tag. By supplying excessively large values for these attributes, an attacker can trigger excessive memory or CPU allocation, leading to application unresponsiveness (Denial of Service). The vulnerability affects multiple versions of Qt across all supported platforms including Windows, macOS, Linux, and mobile OSs. Fixes have been developed in the qtdeclarative module.
Affected products
- The Qt Company Qt 5.0.0 - 6.5.10, 6.6.0 - 6.8.5, 6.9.0 - 6.10.0
Timeline
- 2025-12-03: disclosed