CVE-2023-32573 Integer overflow in n/a

Medium 6.5 Published 10 May 2023 Updated 27 Jan 2025

An integer overflow in QtSvg font handling can cause a denial of service, requiring users to upgrade the Qt library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-32573?

CVE-2023-32573 is a medium-severity vulnerability in Qt Qt, published on 10 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.

Weakness: CWE-369

Which versions are affected by CVE-2023-32573?

It affects 2 products.

Linux distribution packages (14)

`qt5-qtsvg` AlmaLinux:8	All versions	`5.15.3-2.el8`
`qt5-qtsvg-devel` AlmaLinux:8	All versions	`5.15.3-2.el8`
`qt5-qtsvg-examples` AlmaLinux:8	All versions	`5.15.3-2.el8`
`qt5-qtsvg` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-examples` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-examples-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt5-qtsvg-tests-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:5.15.3-2.el8`
`qt6-svg` SUSE:Package Hub 15 SP4	All versions	`6.2.2-bp154.2.3.1`
`qt6-svg-docs` SUSE:Package Hub 15 SP4	All versions	`6.2.2-bp154.2.3.1`
`qt6-svg` openSUSE:Leap 15.4	All versions	`6.2.2-bp154.2.3.1`
`qt6-svg-docs` openSUSE:Leap 15.4	All versions	`6.2.2-bp154.2.3.1`

Products include Qt Qt, Redhat Enterprise Linux.

How do I fix CVE-2023-32573?

Upgrade to a fixed version.

Is CVE-2023-32573 being exploited?

There is no known exploitation of CVE-2023-32573 in the wild and no public exploit code.

All Qt Qt vulnerabilities

Sources

Also known as ALSA-2023:6961, AZL-26670, CLSA-2026-1779807614, CLSA-2026-1780944576, DEBIAN-CVE-2023-32573, GHSA-pjf4-g4fp-5xqm and 10 more.