CVE-2025-12385: 
Qt vulnerability analysis and mitigation

CVE-2025-12385 is a denial-of-service vulnerability in The Qt Company's Qt framework, specifically affecting the Text component in Qt Quick. The flaw stems from missing validation of width and height attributes in <img> tags, which can cause applications to become unresponsive due to excessive resource allocation. It affects Qt versions 5.0.0 through 6.5.10, 6.6.0 through 6.8.5, and 6.9.0 through 6.10.0 across Windows, macOS, Linux, iOS, and Android on x86, ARM, 32-bit, and 64-bit architectures. Disclosed on December 3, 2025, it carries a CVSS v4.0 base score of 8.7 (High) as assigned by The Qt Company (Red Hat CVE, MSRC).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1284 (Improper Validation of Specified Quantity in Input). When Qt Quick's Text component parses HTML-like content containing an <img> tag, it fails to validate or cap the width and height attribute values before allocating rendering resources, allowing arbitrarily large values to trigger excessive memory or CPU consumption. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — meaning any application that renders attacker-controlled text content via Qt Quick's Text component is potentially exploitable. Patch references are available in the Qt project code review system (Qt Code Review #687239, Qt Code Review #687766).

Successful exploitation causes affected Qt Quick applications to become unresponsive, resulting in a denial-of-service condition. The impact is limited to availability — there is no confidentiality or integrity impact — but the vulnerability affects a broad range of platforms and architectures, meaning any Qt-based application that renders user-supplied or remotely fetched text content is at risk. Applications relying on Qt Quick's Text component for displaying rich content (e.g., chat clients, browsers, dashboards) could be crashed or rendered unusable by a malicious actor supplying crafted <img> tags with extreme dimension values (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0012 (0.12%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 277564, 278738, 281824) and Qualys (IDs: 287511, 361574, 361601, 916510, 917568), enabling organizations to identify vulnerable systems (Red Hat CVE, MSRC).

1. Identify target application: Locate a Qt Quick-based application that renders user-supplied or remotely fetched text content using the Text component (e.g., a messaging app, news reader, or dashboard built with Qt Quick).
2. Craft malicious payload: Construct an HTML snippet containing an <img> tag with extremely large width and height attribute values, such as <img width="2147483647" height="2147483647" src="x"/>.
3. Deliver the payload: Supply the crafted content to the target application through any input channel that feeds into a Qt Quick Text component — this could be a chat message, a fetched web resource, a configuration file, or any other text input rendered by the component.
4. Trigger excessive allocation: When the Text component parses the <img> tag without validating the dimension values, it attempts to allocate rendering resources proportional to the specified dimensions, consuming excessive memory or CPU.
5. Achieve denial of service: The application becomes unresponsive or crashes, completing the denial-of-service attack (Qt Code Review #687239).

• Process: Qt Quick application process exhibiting sudden spike in memory or CPU consumption, potentially reaching system resource limits before becoming unresponsive or terminating.
• Logs: Application crash logs or core dumps referencing Qt Quick Text component rendering or image layout routines; out-of-memory (OOM) killer events in system logs on Linux.
• Network: Unusual or repeated delivery of HTML content containing <img> tags with abnormally large width/height attribute values to Qt-based applications that consume remote content.
• File System: Unexpected core dump files generated by Qt application processes in the working directory or system crash dump location.

The Qt Company has released patches addressing this vulnerability; users should upgrade to Qt 6.8.6 or later (for the 6.8.x LTS branch) or the latest available release in the 6.9.x/6.10.x series. The fixes are available in the Qt project code review system (change sets 687239 and 687766 in qtdeclarative). As a workaround where upgrading is not immediately possible, developers should implement application-level input validation to sanitize or reject <img> tags with unreasonably large dimension values before passing content to Qt Quick Text components. Organizations should also monitor applications for unexpected resource consumption as a detection measure (Qt Code Review #687239, Qt Code Review #687766, Red Hat CVE).

The Qt Company published a security advisory blog post describing the issue as improper validation of <img> tag size in the Text component parser (Qt Blog). Sophos noted the vulnerability in its December 2025 Patch Tuesday coverage (Sophos News). Red Hat and Microsoft both published advisories tracking the CVE for their respective Qt-based product distributions. Community reaction has been relatively muted given the absence of public exploits and the limited (DoS-only) impact scope.