CVE-2025-10729
Fixed in a distro release EPSS <1%CVSS 9.4
The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.
Products: qt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | qt6-qtsvg | 6.8.1-1.el10_0.1 |
| AlmaLinux 10 | qt6-qtsvg-devel | 6.8.1-1.el10_0.1 |
| AlmaLinux 10 | qt6-qtsvg-examples | 6.8.1-1.el10_0.1 |
| Debian 12 | qt6-svg | no fix |
| Debian 12 | qtsvg-opensource-src | no fix |
| Debian 13 | qt6-svg | no fix |
| Debian 13 | qtsvg-opensource-src | no fix |
| Debian 14 | qt6-svg | 6.10.2-5 |
| Debian 14 | qtsvg-opensource-src | no fix |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg-debuginfo | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg-debugsource | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg-devel | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg-examples | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.0 | qt6-qtsvg-tests-debuginfo | 0:6.8.1-1.el10_0.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg | 0:6.9.1-2.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-debuginfo | 0:6.9.1-2.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-debugsource | 0:6.9.1-2.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-devel | 0:6.9.1-2.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-examples | 0:6.9.1-2.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | qt6-qtsvg-tests-debuginfo | 0:6.9.1-2.el10_1.1 |
| Rocky Linux 10 | qt6-qtsvg | 0:6.9.1-2.el10_1.1 |
| Rocky Linux 10 | qt6-qtsvg | 0:6.8.1-1.el10_0.1 |
| SUSE Linux Enterprise Server 16.0 | qt6-svg | 6.9.1-160000.3.1 |
| SUSE Linux Enterprise Server 16.0 | qt6-svg-docs | 6.9.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qt6-svg | 6.9.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qt6-svg-docs | 6.9.1-160000.3.1 |
| Ubuntu 22.04 LTS | qt6-svg | no fix |
| Ubuntu 24.04 LTS | qt6-svg | no fix |
| Ubuntu 25.10 | qt6-svg | no fix |
| Ubuntu 26.04 LTS | qt6-svg | no fix |
| Ubuntu 26.10 | qt6-svg | no fix |
| openSUSE Leap 16.0 | qt6-svg | 6.9.1-160000.3.1 |
| openSUSE Leap 16.0 | qt6-svg-docs | 6.9.1-160000.3.1 |
| openSUSE Tumbleweed | qt6-svg | 6.10.0-1.1 |