CVE-2025-5992 — Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service

Back Back to CVE browser

LOW

Passing values outside of expected range to QColorTransferGenericFunction can cause a denial of service

Published Jul 11, 2025

2.3

LOW

CVSS 4.0

EPSS 0.29%

Description

When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.

This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.

Affected products

Vendor Qt Product Qt Default
unaffected
- Version
  6.6.0
  Status
  affected
  Constraints
  <=6.8.3
- Version
  6.9.0
  Status
  affected
  Constraints
  <=6.9.1
- Version
  6.0.0
  Status
  unaffected
  Constraints
  <6.6.0
- Version
  6.8.4
  Status
  unaffected
  Constraints
  <=6.8.3
- Version
  6.9.2
  Status
  unaffected
  Constraints
  <=6.9.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
6.6.0	affected	<=6.8.3
6.9.0	affected	<=6.9.1
6.0.0	unaffected	<6.6.0
6.8.4	unaffected	<=6.8.3
6.9.2	unaffected	<=6.9.1

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	qt6	Fix deferred	n/a

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.29% 0.00293

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00293

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.29% (0.00293)	19.86th	v5 (v2026.06.15)
Jun 15, 2026	0.28% (0.00278)	19.29th	v5 (v2026.06.15)
Jul 11, 2025	0.06% (0.00063)	20.14th	v4 (v2025.03.14)

Weaknesses (1)

CWE-20

Improper Input Validation

References (5)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-5992		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2379493		Issue Tracking
https://codereview.qt-project.org/c/qt/qtbase/+/647919
https://nvd.nist.gov/vuln/detail/CVE-2025-5992
https://www.cve.org/CVERecord?id=CVE-2025-5992