Improper Validation of Specified Quantity in Input vulnerability in Text component parser of the Qt declarative module has been discovered and has been assigned the CVE id CVE-2025-12385
Affected versions: From Qt 5.0.0 to 6.5.10 and from 6.6.0 to 6.8.5 and from 6.9.0 to 6.10.0
Impact: Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation.
This issue affects users of the Text component in Qt Quick. Missing validation of the width and height in the <img> tag could cause an application to become unresponsive.
CVSS 4.0 Score: 8.7
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Mitigation: Ensure that all input to the Qt Quick Text component is only from trusted sources or make sure that all text labels that don't require rich text are explicitly using PlainText as the format.
Solution: Apply the following patches or update to Qt 6.10.1 or 6.8.6 or 6.5.11
Patches:
dev: https://codereview.qt-project.org/c/qt/qtdeclarative/+/687239 and https://codereview.qt-project.org/c/qt/qtdeclarative/+/687766
Qt 6.10: https://codereview.qt-project.org/c/qt/qtdeclarative/+/687935 and
https://codereview.qt-project.org/c/qt/qtdeclarative/+/687936 or https://download.qt.io/official_releases/qt/6.10/CVE-2025-12385-qtdeclarative-6.10-0001.diff and https://download.qt.io/official_releases/qt/6.10/CVE-2025-12385-qtdeclarative-6.10-0002.diff
Qt 6.9: https://codereview.qt-project.org/c/qt/qtdeclarative/+/692460 and https://codereview.qt-project.org/c/qt/qtdeclarative/+/690033 or https://download.qt.io/official_releases/qt/6.9/CVE-2025-12385-qtdeclarative-6.9-0001.diff and https://download.qt.io/official_releases/qt/6.9/CVE-2025-12385-qtdeclarative-6.9-0002.diff
Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qtdeclarative/+/687955 and https://codereview.qt-project.org/c/qt/tqtc-qtdeclarative/+/687954 or https://download.qt.io/official_releases/qt/6.8/CVE-2025-12385-qtdeclarative-6.8-0001.diff and https://download.qt.io/official_releases/qt/6.8/CVE-2025-12385-qtdeclarative-6.8-0002.diff
Qt 6.5: https://codereview.qt-project.org/c/qt/tqtc-qtdeclarative/+/688673 and https://codereview.qt-project.org/c/qt/tqtc-qtdeclarative/+/688672 or https://download.qt.io/official_releases/qt/6.5/CVE-2025-12385-qtdeclarative-6.5-0001.diff and https://download.qt.io/official_releases/qt/6.5/CVE-2025-12385-qtdeclarative-6.5-0002.diff
