CVE-2025-12385

A flaw was found in the Qt Quick Text component of Qt. Due to missing validation of the width and height attributes in image tags, an attacker can trigger excessive resource allocation by supplying specially crafted content. This flaw allows an application to freeze or become unresponsive, resulting in a Denial of Service (DoS).

This vulnerability is rated as Important severity because an attacker can trigger an application hang or crash remotely without privileges, causing a complete loss of process availability. In typical Red Hat Enterprise Linux deployments, Qt Quick libraries are not used by default system daemons, restricting exposure to desktop environments or custom software processing external rich text. Applications are only vulnerable if they directly parse and render untrusted rich text or HTML-formatted inputs via the Qt Quick Text element.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce strict upper bounds on parsed width and height attributes in rich text image tags before allocating memory in the Qt Quick Text component: upgrade to the fixed Qt5 Qtdeclarative/Mingw Qt5 Qtdeclarative/Qt6 Qtdeclarative/Mingw Qt6 Qtdeclarative builds, which validate and limit width and height attributes parsed from <img> tags in rich text, closing crafted rich text containing <img> tags with oversized width or height attributes. Until patched, this is a concern on applications rendering untrusted rich text using the Qt Quick Text component, so sanitize or reject untrusted rich text containing <img> tags before passing it to the Qt Quick Text component for rendering. As a compensating measure, monitor cgroup memory pressure metrics and out-of-memory events using memory.events and PSI to detect excessive resource allocations, impose process address space limits using ulimit or prlimit RLIMIT_AS to cap total memory allocation and prevent system-wide exhaustion, configure service watchdogs and automatic restart policies using systemd WatchdogSec and Restart to recover responsive operation, and restrict maximum memory consumption using cgroups v2 resource limits to isolate allocation spikes within the container or slice. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing image dimension validation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)