Executive brief
A vulnerability exists in the Qt development framework's networking component when used on Windows systems. This flaw can lead to a gradual depletion of system resources, eventually causing applications built with Qt to crash or become unresponsive. This impacts the long-term stability and availability of software relying on Qt for network communications.
Technical details
An incomplete cleanup vulnerability (CWE-459) exists in the Schannel-based networking implementation of the Qt framework on Windows. The flaw occurs within the Qt Network module, where resources are not properly released during network operations. An attacker can exploit this over a network without authentication to cause a gradual resource leak. Over an extended period, this leads to a Denial of Service (DoS) as system resources are exhausted. The issue affects Qt versions 5.15.0 through 6.8.3 and 6.9.0 before 6.9.2.
Affected products
- The Qt Company Qt 5.15.0 through 6.8.3, 6.9.0 before 6.9.2
Timeline
- 2025-10-16: advisory: Initial disclosure by The Qt Company