CVE-2025-10728
Fixed in a distro release EPSS <1%CVSS 9.4
When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS
Products: qt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | qt6-qtsvg | 6.9.1-2.el10_1.2 |
| AlmaLinux 10 | qt6-qtsvg-devel | 6.9.1-2.el10_1.2 |
| AlmaLinux 10 | qt6-qtsvg-examples | 6.9.1-2.el10_1.2 |
| Debian 13 | qt6-svg | no fix |
| Debian 14 | qt6-svg | 6.9.2-3 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-debuginfo | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-debugsource | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-devel | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-examples | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-tests-debuginfo | 0:6.9.1-2.el10_1.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg | 0:6.8.1-1.el10_0.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg-debuginfo | 0:6.8.1-1.el10_0.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg-debugsource | 0:6.8.1-1.el10_0.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg-devel | 0:6.8.1-1.el10_0.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg-examples | 0:6.8.1-1.el10_0.2 |
| Red Hat Enterprise Linux eus 10.0 | qt6-qtsvg-tests-debuginfo | 0:6.8.1-1.el10_0.2 |
| Rocky Linux 10 | qt6-qtsvg | 0:6.9.1-2.el10_1.2 |
| Ubuntu 22.04 LTS | qt6-svg | no fix |
| Ubuntu 24.04 LTS | qt6-svg | no fix |
| Ubuntu 25.10 | qt6-svg | no fix |
| Ubuntu 26.04 LTS | qt6-svg | no fix |
| Ubuntu 26.10 | qt6-svg | no fix |
| openSUSE Tumbleweed | qt6-svg | 6.10.0-1.1 |