CVE-2025-5683

A flaw was found in qt. Loading a specially crafted ICNS image file within QImage results in a crash. This flaw allows a local attacker to provide a malicious image. The vulnerability is exploited via the image loading process, leading to application termination.

The vulnerability involves a crash triggered by a specifically crafted ICNS image file within QImage. While the attack vector is remote (AV:N) and requires no authentication (PR:N), user interaction (UI:R) is necessary to load the malicious image. This limits the ease of exploitation compared to vulnerabilities that allow for fully automated remote code execution. A crash, while disruptive, doesn’t inherently lead to arbitrary code execution or data compromise. However, a denial of service is possible, and a determined attacker could potentially exploit the crash to gain further information or potentially escalate to a more severe outcome. Given the ubiquity of Qt in various applications, a crash vulnerability warrants a Moderate rating. The lack of authentication and remote attack vector are mitigating factors, but the potential for denial of service and the wide usage of Qt contribute to the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.