What’s Vulnerable › Vulnerabilities

CVE-2025-3512: Buffer overflow in QTextMarkdownImporter

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-11 · updated 2026-07-29
• Weakness: CWE-122

Description

There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.

Affected products

• Qt: from 6.8.0 before 6.8.4 — fixed in 6.8.4

How to fix

Upgrade to a fixed version: Qt 6.8.4. Check the vendor advisory for mitigations.

References

• https://codereview.qt-project.org/c/qt/qtbase/+/635546
• http://www.openwall.com/lists/oss-security/2025/04/24/4
• http://www.openwall.com/lists/oss-security/2025/04/24/5
• http://www.openwall.com/lists/oss-security/2025/04/24/6
• http://www.openwall.com/lists/oss-security/2025/04/25/1
• http://www.openwall.com/lists/oss-security/2025/04/25/2

Get alerted when CVE-2025-3512 or the next vulnerability affects your stack