{"id":"CVE-2025-5455","title":"An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\n\n\n\nIf the function was called with malformed data, for example, an URL that\ncont…","summary":"An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\n\n\n\nIf the function was called with malformed data, for example, an URL that\ncont…","severity":"medium","cwe":["CWE-20","CWE-617"],"published":"2025-06-02","updated":"2026-07-29","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-5455","references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/642006","label":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5455.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-5455"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369722"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5455"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5455"},{"url":"https://access.redhat.com/errata/RHSA-2025:9486"},{"url":"https://access.redhat.com/errata/RHSA-2025:11841"},{"url":"https://access.redhat.com/errata/RHSA-2025:9462"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00383,"epssPercentile":0.32208,"ingestedAt":"2026-07-29T09:45:30.532Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v.9.4)","affected":["enterprise_linux 7","enterprise_linux 8","enterprise_linux_appstream_v_10","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_10","codeready_linux_builder_eus_v_9_4","enterprise_linux_codeready_linux_builder_v_9"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_10","codeready_linux_builder_eus_v_9_4","enterprise_linux_codeready_linux_builder_v_9"],"cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","slug":"CVE-2025-5455","body":"## Overview\n\nAn issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.\n\n\n\nIf the function was called with malformed data, for example, an URL that\ncontained a \"charset\" parameter that lacked a value (such as\n\"data:charset,\"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service\n(abort).\n\n\n\nThis impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:9486** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2025-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:9486)\n- **RHSA-2025:11841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2025-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2025:11841)\n- **RHSA-2025:9462** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:9462)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5455.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222931,"id":"CVE-2025-5455","ts":1792151724982,"field":"cvss","old":null,"new":"5.3"},{"seq":222930,"id":"CVE-2025-5455","ts":1792151724982,"field":"severity","old":"none","new":"medium"}]}