CVE-2025-5683

EUVD-2025-16968
When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. 

This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
qtqt
6.3.0 ≤
𝑥
< 6.5.10
qtqt
6.6.0 ≤
𝑥
< 6.8.5
qtqt
6.9.0 ≤
𝑥
< 6.9.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qt6-imageformats
bookworm
no-dsa
forky
6.10.2-3
fixed
sid
6.10.2-3
fixed
trixie
6.8.2-4
fixed
qtimageformats-opensource-src
bookworm
no-dsa
bullseye
postponed
forky
5.15.19-2
fixed
sid
5.15.19-2
fixed
trixie
5.15.15-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qt6-imageformats
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
needs-triage
qtimageformats-opensource-src
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
needs-triage
xenial
needs-triage