CVE-2025-5992 Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service
Attackers can cause a denial of service in Qt applications by providing crafted ICC profiles to QColorSpace::fromICCProfile, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-5992?
CVE-2025-5992 is a low-severity denial of service vulnerability in Qt, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.
This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.
Weakness: CWE-20
Which versions are affected by CVE-2025-5992?
Linux distribution packages (1)
qt6-base openSUSE:Tumbleweed | All versions | 6.9.1-2.1 |
How do I fix CVE-2025-5992?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-5992 being exploited?
There is no known exploitation of CVE-2025-5992 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-5992, GHSA-45wh-m547-4rh9, UBUNTU-CVE-2025-5992, openSUSE-SU-2025:15345-1.