When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.
This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.
CVSS Details
- CVSS 4.0 Base Score: 2.3 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qt6-base | Jul 14, 2025 | Jul 11, 2025 |
| Freebsd | — | Upgrade qt6-base | Dec 10, 2025 | Aug 28, 2025 |
| Suse | — | Upgrade libQt6Core6Upgrade libQt6PrintSupport6Upgrade qt6-sql-sqliteUpgrade libQt6Test6Upgrade qt6-xml-private-develUpgrade libQt6Concurrent6Upgrade qt6-network-develUpgrade qt6-kmssupport-private-develUpgrade qt6-sql-develUpgrade libQt6DBus6Upgrade qt6-base-docs-htmlUpgrade qt6-docs-commonUpgrade qt6-printsupport-private-develUpgrade qt6-xml-develUpgrade qt6-exampleicons-devel-staticUpgrade qt6-sql-postgresqlUpgrade qt6-base-private-develUpgrade qt6-network-private-develUpgrade qt6-printsupport-cupsUpgrade qt6-concurrent-develUpgrade qt6-sql-private-develUpgrade qt6-network-tlsUpgrade libQt6Xml6Upgrade qt6-test-develUpgrade qt6-printsupport-develUpgrade qt6-core-develUpgrade qt6-base-common-develUpgrade libQt6OpenGLWidgets6Upgrade qt6-platformsupport-private-develUpgrade qt6-widgets-private-develUpgrade libQt6Gui6Upgrade qt6-platformtheme-xdgdesktopportalUpgrade qt6-networkinformation-glibUpgrade qt6-platformsupport-devel-staticUpgrade qt6-dbus-private-develUpgrade libQt6OpenGL6Upgrade qt6-base-docs-qchUpgrade qt6-core-private-develUpgrade qt6-openglwidgets-develUpgrade qt6-base-develUpgrade qt6-widgets-develUpgrade qt6-opengl-private-develUpgrade qt6-networkinformation-nmUpgrade qt6-gui-private-develUpgrade qt6-dbus-develUpgrade qt6-platformtheme-gtk3Upgrade libQt6Widgets6Upgrade qt6-test-private-develUpgrade libQt6Network6Upgrade qt6-sql-unixODBCUpgrade qt6-opengl-develUpgrade libQt6Sql6Upgrade qt6-sql-mysqlUpgrade qt6-base-examplesUpgrade qt6-kmssupport-devel-staticUpgrade qt6-gui-devel | Nov 5, 2025 | Nov 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub