CVE-2025-12385

EUVD-2025-201103

03.12.2025, 20:16

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.
This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.

This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 19%

Amazon Linux Releases

Amazon Package

Release

qt5-qtbase

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-common

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-debuginfo

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-devel

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-examples

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-gui

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-mysql

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-odbc

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-postgresql

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-private-devel

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtbase-static

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtdeclarative

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtdeclarative-debuginfo

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtdeclarative-devel

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtdeclarative-examples

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

qt5-qtdeclarative-static

Amazon Linux 2

0:5.15.3-1.amzn2.0.2

fixed

Azure Linux Releases

Azure Package

Release

qt5-qtdeclarative

CBL-Mariner 2.0

0:5.12.5-6.cm2

fixed

qtdeclarative

Azure Linux 3.0

0:6.6.1-2.azl3

fixed

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://codereview.qt-project.org/c/qt/qtdeclarative/+/687239

https://codereview.qt-project.org/c/qt/qtdeclarative/+/687766