VulnerabilityDeferred
CVE-2025-3512
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter.
MEDIUM 4.8EPSS 0.22%
Does this matter?
Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.
Description
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
- CVSS 4.0
- 4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.22% probability · 13th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-122
- Source
- a59d8014-47c4-4630-ab43-e1b13cbe58e3
References
- https://codereview.qt-project.org/c/qt/qtbase/+/635546
- http://www.openwall.com/lists/oss-security/2025/04/24/4
- http://www.openwall.com/lists/oss-security/2025/04/24/5
- http://www.openwall.com/lists/oss-security/2025/04/24/6
- http://www.openwall.com/lists/oss-security/2025/04/25/1
- http://www.openwall.com/lists/oss-security/2025/04/25/2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.