---
id: CVE-2025-5455
title: >-
  An issue was found in the private API function qDecodeDataUrl() in QtCore,
  which is used in QTextDocument and QNetworkReply, and, potentially, in user
  code.




  If the function was called with malformed data, for example, an URL that

  cont…
summary: >-
  An issue was found in the private API function qDecodeDataUrl() in QtCore,
  which is used in QTextDocument and QNetworkReply, and, potentially, in user
  code.




  If the function was called with malformed data, for example, an URL that

  cont…
severity: medium
cwe:
  - CWE-20
  - CWE-617
published: '2025-06-02'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5455'
references:
  - url: 'https://codereview.qt-project.org/c/qt/qtbase/+/642006'
    label: a59d8014-47c4-4630-ab43-e1b13cbe58e3
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5455.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-5455'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2369722'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-5455'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5455'
  - url: 'https://access.redhat.com/errata/RHSA-2025:9486'
  - url: 'https://access.redhat.com/errata/RHSA-2025:11841'
  - url: 'https://access.redhat.com/errata/RHSA-2025:9462'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00383
epssPercentile: 0.32208
ingestedAt: '2026-07-29T09:45:30.532Z'
vendor: Red Hat
product: Red Hat Enterprise Linux AppStream EUS (v.9.4)
affected:
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_eus_v_9_4
  - enterprise_linux_appstream_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - codeready_linux_builder_eus_v_9_4
  - enterprise_linux_codeready_linux_builder_v_9
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_eus_v_9_4
  - enterprise_linux_appstream_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - codeready_linux_builder_eus_v_9_4
  - enterprise_linux_codeready_linux_builder_v_9
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
---

## Overview

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.



If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).



This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2025:9486** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2025-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:9486)
- **RHSA-2025:11841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2025-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2025:11841)
- **RHSA-2025:9462** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:9462)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5455.json)