CVE-2025-5683

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-05 · updated 2026-07-29
Weakness: CWE-770

Description

When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.

Affected products

Qt: from 6.3.0 before 6.5.10; from 6.6.0 before 6.8.5; from 6.9.0 before 6.9.1 — fixed in 6.5.10, 6.8.5, 6.9.1

How to fix

Upgrade to a fixed version: Qt 6.5.10, 6.8.5, 6.9.1. Check the vendor advisory for mitigations.

References

https://codereview.qt-project.org/c/qt/qtimageformats/+/644548
https://issues.oss-fuzz.com/issues/415350704

Get alerted when CVE-2025-5683 or the next vulnerability affects your stack