qt vulnerabilities and fixes

Recent CVEs affecting qt, with upgrade or downgrade steps. 52 tracked.

qt has 52 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 42. Most recent: 2025-06-05. Highest priority: CVE-2018-19873 (score 66/100).

• CVE-2023-51714 CRITICAL 9.8 MITIGATE UPGRADE An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5
• CVE-2020-0570 HIGH 7.3 UPGRADE MITIGATE Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to
• CVE-2025-5683 MEDIUM 5.5 UPGRADE When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash.  This issu
• CVE-2024-39936 HIGH 8.6 UPGRADE An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, an
• CVE-2024-36048 CRITICAL 9.8 UPGRADE MITIGATE QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before
• CVE-2024-30161 MEDIUM 6.5 DOWNGRADE In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for We
• CVE-2024-25580 MEDIUM 6.2 UPGRADE An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5
• CVE-2023-43114 MEDIUM 5.5 UPGRADE An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windo
• CVE-2023-38197 HIGH 7.5 UPGRADE An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3
• CVE-2023-37369 HIGH 7.5 UPGRADE MITIGATE In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application cras
• CVE-2023-34410 MEDIUM 5.3 MITIGATE MITIGATE An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2
• CVE-2023-33285 MEDIUM 5.3 UPGRADE An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1
• CVE-2023-32763 HIGH 7.5 UPGRADE An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1
• CVE-2023-32762 MEDIUM 5.3 MITIGATE UPGRADE An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1
• CVE-2023-32573 MEDIUM 6.5 UPGRADE MITIGATE In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m
• CVE-2023-24607 HIGH 7.5 UPGRADE Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and th
• CVE-2022-43591 HIGH 8.8 DOWNGRADE A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2
• CVE-2022-40983 HIGH 8.8 DOWNGRADE An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2
• CVE-2022-25634 HIGH 7.5 UPGRADE Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
• CVE-2022-25255 HIGH 7.8 UPGRADE In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a bina
• CVE-2021-3481 HIGH 7.1 DOWNGRADE A flaw was found in Qt
• CVE-2021-38593 HIGH 7.5 UPGRADE MITIGATE Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called f
• CVE-2021-28025 MEDIUM 5.5 DOWNGRADE Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows l
• CVE-2020-17507 MEDIUM 5.3 UPGRADE MITIGATE An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1
• CVE-2020-13962 HIGH 7.5 DOWNGRADE UPGRADE Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL'
• CVE-2020-12267 CRITICAL 9.8 DOWNGRADE setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
• CVE-2018-21035 HIGH 7.5 UPGRADE In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages
• CVE-2018-19873 CRITICAL 9.8 UPGRADE MITIGATE An issue was discovered in Qt before 5.11.3
• CVE-2018-19872 MEDIUM 5.5 DOWNGRADE MITIGATE An issue was discovered in Qt 5.11
• CVE-2018-19871 MEDIUM 6.5 UPGRADE MITIGATE An issue was discovered in Qt before 5.11.3
• CVE-2018-19870 HIGH 8.8 UPGRADE MITIGATE An issue was discovered in Qt before 5.11.3
• CVE-2018-19869 MEDIUM 6.5 UPGRADE MITIGATE An issue was discovered in Qt before 5.11.3
• CVE-2018-19865 HIGH 7.5 UPGRADE MITIGATE A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x bef
• CVE-2018-15518 HIGH 8.8 UPGRADE MITIGATE QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illeg
• CVE-2017-15011 HIGH 7.5 DOWNGRADE The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote acce
• CVE-2017-10905 MEDIUM 5.3 UPGRADE A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environm
• CVE-2017-10904 CRITICAL 9.8 UPGRADE Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors
• CVE-2015-9541 HIGH 7.5 UPGRADE MITIGATE Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandle
• CVE-2015-7298 MEDIUM 5.1 UPGRADE DOWNGRADE ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply
• CVE-2015-1860 MEDIUM 6.8 MITIGATE UPGRADE Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before
• CVE-2015-1859 MEDIUM 6.8 MITIGATE UPGRADE Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7
• CVE-2015-1858 MEDIUM 6.8 UPGRADE DOWNGRADE Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before
• CVE-2015-1290 HIGH 8.8 UPGRADE UPGRADE The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, all
• CVE-2015-0295 MEDIUM 5.0 MITIGATE MITIGATE The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color comp
• CVE-2014-0190 MEDIUM 4.3 UPGRADE MITIGATE The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer d
• CVE-2013-4549 MEDIUM 5.0 UPGRADE DOWNGRADE QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory cons
• CVE-2013-0254 LOW 3.6 DOWNGRADE The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.
• CVE-2012-6093 MEDIUM 4.3 UPGRADE MITIGATE The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using cert
• CVE-2012-5624 MEDIUM 4.3 UPGRADE DOWNGRADE The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-
• CVE-2011-3194 HIGH 9.3 DOWNGRADE Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause
• CVE-2011-3193 HIGH 9.3 UPGRADE UPGRADE Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as use
• CVE-2010-5076 MEDIUM 4.3 UPGRADE DOWNGRADE QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.

FAQ

How do I fix qt vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is qt being exploited right now?

None of the tracked qt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which qt CVE should I patch first?

CVE-2018-19873 currently ranks highest (66/100): An issue was discovered in Qt before 5.11.3.

RSS feed for qt · ← Back to latest CVEs