CVE-2025-30348 Denial of service in Qt

What is CVE-2025-30348?

CVE-2025-30348 is a medium-severity denial of service vulnerability in Qt Qt, published on 21 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).

Weakness: CWE-407

Which versions are affected by CVE-2025-30348?

It affects 1 product.

Products include Qt Qt.

How do I fix CVE-2025-30348?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-30348 being exploited?

There is no known exploitation of CVE-2025-30348 in the wild and no public exploit code.

Other vulnerabilities in Qt Qt

• CVE-2020-12267 Use after free in n/a Critical 9.8
• CVE-2017-10904 Command injection in Qt for Android Critical 9.8
• CVE-2011-3194 Memory corruption in n/a Critical 9.3
• CVE-2022-40983 Integer overflow in Qt High 8.8
• CVE-2022-43591 Memory corruption in Qt High 8.8

All Qt Qt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-58948, AZL-58958, DEBIAN-CVE-2025-30348, GHSA-hc3c-6xqp-r265, OESA-2025-1384, OESA-2025-1385 and 5 more.