CVE-2025-12385 - CVE House

Back to Database

Status published High CVE-2025-12385

Improper validation of <img> tag size in Text component parser

8.7 CVSS

Vulnerability Description

Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive. This issue affects Qt: from 5.0.0 through 6.5.10, from 6.6.0 through 6.8.5, from 6.9.0 through 6.10.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12385

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Qt Company

View All →

Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend

Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service

Use after free in QHttp2ProtocolHandler

When loading a specifically crafted ICNS format image file in...

Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

Affected Vendor

The Qt Company

View all reports →

Affected Software

Qt

Vulnerable Versions:

5.0.0, 6.6.0, 6.9.0

Timeline

Official Publish: December 3rd, 2025

Last Modified: December 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-770 CWE-1284

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery