CVE-2025-12385

Executive Summary

CVE-2025-12385 is a denial-of-service (DoS) vulnerability in the Qt Quick Text component, affecting Qt versions from 5.0.0 through 6.10.0. The flaw resides in the improper validation of width and height attributes within <img> tags, allowing an attacker to trigger excessive memory allocation and cause the application to become unresponsive. This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1284 (Improper Validation of Specified Quantity in Input). No public exploit code or proof-of-concept is currently available, and no official patch has been released by The Qt Company.

Supply Chain & Package Security

Qt is a widely used cross-platform application development framework, distributed via official installers, package managers (e.g., vcpkg, Conan, apt, brew), and source code. This vulnerability affects the Qt Quick module, which is commonly used in embedded systems, mobile applications, and desktop software. Organizations using Qt in their supply chain should assess their exposure and apply mitigations until an official patch is released.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full vector. However, based on the vulnerability description, a reasonable assessment is:

• Attack Vector (AV): Network (likely, as the input could come from a remote source)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (user must view the malicious content)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High

Estimated CVSS v3.1 Score: 7.5 (High) – AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Threat Level: High – The vulnerability can be triggered remotely with low complexity, leading to application unavailability.

Deep Dive & Mechanics

The vulnerability exists in the Qt Quick Text component's handling of HTML-like <img> tags. When rendering rich text, Qt Quick parses <img> tags and attempts to allocate resources based on the specified width and height attributes. The flaw is that these attributes are not validated for reasonable limits.

Attack Scenario:

1. An attacker crafts a malicious input containing an <img> tag with extremely large width and height values (e.g., width="99999999" height="99999999").
2. This input is fed into a Qt Quick application that renders rich text (e.g., a chat client, document viewer, or web browser).
3. The Qt Quick engine attempts to allocate memory proportional to the specified dimensions, leading to excessive memory consumption.
4. The application becomes unresponsive or crashes due to memory exhaustion.

Root Cause:

• Missing validation of width and height attributes in the <img> tag parser.
• No throttling or limit on the allocation size.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix:

Vulnerable Code (Qt Quick Text parser):

void TextEngine::parseImgTag(const QUrl &source, int width, int height) {
    // No validation of width/height
    QImage image(width, height, QImage::Format_ARGB32);
    // ... allocate and render
}

Patched Code (Hypothetical):

void TextEngine::parseImgTag(const QUrl &source, int width, int height) {
    const int MAX_IMG_DIMENSION = 4096; // Reasonable limit
    if (width > MAX_IMG_DIMENSION || height > MAX_IMG_DIMENSION) {
        // Log warning and skip or scale down
        qWarning() << "Image dimensions exceed limit, skipping.";
        return;
    }
    QImage image(width, height, QImage::Format_ARGB32);
    // ... allocate and render
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target application using Qt Quick with rich text rendering (e.g., a QML-based chat client).
• Ability to inject HTML-like content into the Text component.

Exploit Payload:

<img width="99999999" height="99999999" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" />

Execution:

1. Send the payload to the target application via any input field that renders rich text (e.g., chat message, document content).
2. The application will attempt to allocate a massive image buffer, causing memory exhaustion and unresponsiveness.

Blue Team

Detection:

• Monitor for excessive memory allocation events in Qt applications.
• Use process monitoring tools to detect abnormal memory usage spikes.

Mitigation:

• Implement input validation on the application side to limit the size of <img> tags before passing to Qt Quick.
• Use a WebView or sandboxed renderer for untrusted content.
• Apply resource limits (e.g., cgroups, ulimit) to the application process.

Indicators of Compromise (IOCs)

• Memory Usage: Sudden spike in memory consumption by a Qt application (e.g., > 1 GB in seconds).
• Application Logs: Warnings or errors related to image allocation failures.
• Network Traffic: Inbound data containing <img> tags with abnormally large width/height values.
• Process State: Application process becomes unresponsive (zombie or hung state).

Detection Engineering

YARA Rule

rule CVE_2025_12385_Qt_Quick_DoS {
    meta:
        description = "Detects malicious input targeting CVE-2025-12385 in Qt Quick Text component"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12385"
    strings:
        $img_tag = /<img\s+[^>]*width\s*=\s*["']?\d{5,}["']?[^>]*height\s*=\s*["']?\d{5,}["']?/ nocase
        $img_tag2 = /<img\s+[^>]*height\s*=\s*["']?\d{5,}["']?[^>]*width\s*=\s*["']?\d{5,}["']?/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-12385 Qt Quick Text Component DoS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-12385 by sending oversized img tags to Qt applications
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: qt
detection:
    selection:
        EventID: 1001  # Example: Application error log
        Message|contains|all:
            - '<img'
            - 'width'
            - 'height'
            - '99999'
    condition: selection
falsepositives:
    - Legitimate use of large images (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-12385 Qt Quick Text Component DoS Attempt"; flow:to_server,established; content:"<img"; nocase; content:"width"; distance:0; within:100; content:"height"; distance:0; within:100; pcre:"/width\s*=\s*["']?\d{5,}["']?/i"; pcre:"/height\s*=\s*["']?\d{5,}["']?/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize all user-supplied content before passing to Qt Quick Text components. Strip or limit <img> tag dimensions.
2. Resource Limits: Apply operating system-level resource limits (e.g., ulimit -v on Linux) to the application process.
3. Update: Monitor The Qt Company's security advisories for an official patch. When available, update to the patched version.

Long-Term Fix:

• The Qt Company should implement validation of width and height attributes in the <img> tag parser, enforcing reasonable maximum values (e.g., 4096 pixels).

Workaround:

• Disable rich text rendering in Qt Quick Text components if not required.
• Use a WebView with a content security policy that restricts image sizes.

Valters IT