What’s Vulnerable › Vulnerabilities

CVE-2025-23050

• Severity: low (CVSS 3.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-31 · updated 2026-10-19
• Weakness: CWE-125

Description

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.

Affected products

• Qt: before 5.15.19; from 6.0.0 before 6.5.9; from 6.6.0 before 6.8.2 — fixed in 5.15.19, 6.5.9, 6.8.2

How to fix

Upgrade to a fixed version: Qt 5.15.19, 6.5.9, 6.8.2. Check the vendor advisory for mitigations.

References

• https://codereview.qt-project.org/q/QLowEnergyController
• https://www.qt.io/blog/security-advisory-qlowenergycontroller-on-linux

Get alerted when CVE-2025-23050 or the next vulnerability affects your stack