CVE-2025-5992 - CVE House

Back to Database

Status published Low CVE-2025-5992

Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service

2.3 CVSS

Vulnerability Description

When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5992

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

OSS-Fuzz

References

https://codereview.qt-project.org/c/qt/qtbase/+/647919

More from The Qt Company

View All →

Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend

Use after free in QHttp2ProtocolHandler

When loading a specifically crafted ICNS format image file in...

Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

Improper Link Resolution Before File Access in QFileSystemEngine on Windows

Affected Vendor

The Qt Company

View all reports →

Affected Software

Qt

Vulnerable Versions:

6.0.0, 6.6.0, 6.8.4, 6.9.0, 6.9.2

Timeline

Official Publish: July 11th, 2025

Last Modified: July 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation