What’s Vulnerable › Vulnerabilities

CVE-2024-25580

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-27 · updated 2026-06-17
• Weakness: CWE-120

Description

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.

Affected products

• Qt: from 5.12.0 before 5.15.17; from 6.0.0 before 6.2.12; from 6.3.0 before 6.5.5; from 6.6.0 before 6.6.2 — fixed in 5.15.17, 6.2.12, 6.5.5, 6.6.2

How to fix

Upgrade to a fixed version: Qt 5.15.17, 6.2.12, 6.5.5, 6.6.2. Check the vendor advisory for mitigations.

References

• https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
• https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images

Get alerted when CVE-2024-25580 or the next vulnerability affects your stack