CVE-2025-5992

Executive Summary

CVE-2025-5992 is a denial-of-service vulnerability in the Qt framework affecting the QColorTransferGenericFunction component. When an attacker supplies values outside the expected range—specifically through a crafted ICC profile passed to QColorSpace::fromICCProfile()—the function can enter an infinite loop or cause excessive resource consumption, leading to a denial of service. The vulnerability impacts Qt versions 6.6.0 through 6.8.3 and 6.9.0 through 6.9.1. Patches are available in Qt 6.8.4 and 6.9.2.

This vulnerability is particularly concerning for applications that process user-supplied ICC profiles, such as image editors, color management tools, or any software that uses Qt’s color space APIs. While no public exploit code exists, the attack vector is straightforward: an attacker can craft a malicious ICC profile that, when parsed, triggers the vulnerable code path.

Supply Chain & Package Security

Qt is a widely used cross-platform framework, and this vulnerability affects applications that bundle or depend on Qt libraries. Organizations using Qt in their software supply chain should verify their Qt version and apply patches promptly. The vulnerability does not affect the Qt package manager directly, but downstream applications that rely on Qt’s color management are at risk.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely because the vector was not yet assigned. Based on the vulnerability characteristics, a reasonable CVSS vector would be:

• Attack Vector (AV): Network (AV:N) – The attacker can send a crafted ICC profile over the network.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – The victim must open the malicious ICC profile.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Estimated Base Score: 6.5 (Medium)

Threat Level: Medium – Exploitation requires user interaction, but the impact is a denial of service.

Deep Dive & Mechanics

The vulnerability resides in the QColorTransferGenericFunction class, which is used to represent generic transfer functions in color spaces. When QColorSpace::fromICCProfile() parses an ICC profile, it extracts the transfer function parameters and passes them to QColorTransferGenericFunction. If the parameters are outside the expected range (e.g., negative values, extremely large values, or NaN), the function may enter an infinite loop or consume excessive CPU resources.

The root cause is insufficient input validation. The function does not check for edge cases such as:

• Negative or zero values for parameters that should be positive.
• Extremely large values that cause integer overflow or floating-point exceptions.
• NaN or infinity values that lead to undefined behavior.

An attacker can craft an ICC profile with malformed transfer function parameters. When the application calls QColorSpace::fromICCProfile() on this profile, the vulnerable code path is triggered, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (Qt 6.6.0 - 6.8.3, 6.9.0 - 6.9.1):

// QColorTransferGenericFunction constructor (simplified)
QColorTransferGenericFunction::QColorTransferGenericFunction(const QVector<double> &params)
{
    // No validation of params
    m_params = params;
    // ... subsequent calculations may loop infinitely
}

Patched Code (Qt 6.8.4, 6.9.2):

// Patched constructor with input validation
QColorTransferGenericFunction::QColorTransferGenericFunction(const QVector<double> &params)
{
    // Validate parameters
    for (double p : params) {
        if (!std::isfinite(p) || p < 0.0 || p > 1e6) {
            // Set to default safe values
            m_params = {1.0, 0.0, 0.0, 1.0, 0.0, 0.0, 1.0};
            return;
        }
    }
    m_params = params;
    // ... safe calculations
}

The patch adds a validation loop that checks each parameter for finiteness and reasonable range. If any parameter is invalid, the function defaults to a safe set of parameters, preventing the denial of service.

Exploitation & Lab Setup

Red Team

Attack Scenario: An attacker crafts a malicious ICC profile and tricks a user into opening it with a Qt-based application (e.g., an image viewer or editor).

Step-by-Step Exploitation:

1. Craft the Malicious ICC Profile: Use a hex editor or a script to create an ICC profile with a malformed parametricCurveType tag. For example, set the gamma value to a negative number or NaN.

2. Deliver the Payload: Send the profile via email, upload to a website, or use social engineering to get the victim to open it.

3. Trigger the Vulnerability: When the victim’s application calls QColorSpace::fromICCProfile() on the malicious profile, the vulnerable code path is executed, causing a denial of service.

Example Malicious ICC Profile (Hex Dump):

00000000  00 00 00 0c 61 70 70 6c  00 00 00 00 00 00 00 00  |....appl........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
...
00000100  70 61 72 61 00 00 00 0c  00 00 00 00 00 00 00 00  |para............|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
...

Note: No public exploit code is available. The above is a conceptual description.

Blue Team

Detection & Prevention:

1. Input Validation: Ensure that any ICC profile processed by the application is validated before being passed to QColorSpace::fromICCProfile(). Use a whitelist of allowed parameters.

2. Resource Limits: Set CPU time limits for color space parsing to prevent infinite loops.

3. Sandboxing: Run the color space parsing in a separate process with limited resources.

4. Monitoring: Monitor for excessive CPU usage or application hangs when processing ICC profiles.

Indicators of Compromise (IOCs)

• File Hashes: (None available – no public exploit)
• Network Patterns: Unusual ICC profile files being transferred (e.g., via email or web upload).
• Behavioral: Application hangs or crashes when opening specific ICC profiles.
• Log Entries: Repeated calls to QColorSpace::fromICCProfile() with malformed data.

Detection Engineering

YARA Rule

rule CVE_2025_5992_Qt_ICC_DoS {
    meta:
        description = "Detects malicious ICC profiles targeting CVE-2025-5992"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5992"
    strings:
        $icc_magic = "acsp"  // ICC profile magic bytes
        $parametric_tag = "para"  // parametricCurveType tag
        $gamma_negative = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }  // placeholder for negative gamma
    condition:
        $icc_magic at 0 and $parametric_tag and #gamma_negative > 0
}

Sigma Rule

title: CVE-2025-5992 Qt ICC Profile Denial of Service
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-5992 via malicious ICC profiles
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\your_app.exe'
        CommandLine|contains: '*.icc'
    condition: selection
falsepositives:
    - Legitimate ICC profile processing
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-5992 Qt ICC Profile DoS Attempt"; flow:to_server,established; content:"|61 63 73 70|"; offset:0; depth:4; content:"|70 61 72 61|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Upgrade to Qt 6.8.4 or 6.9.2 (or later). These versions include the fix for CVE-2025-5992.

2. Workaround: If patching is not possible, implement input validation for ICC profiles before passing them to QColorSpace::fromICCProfile(). Reject profiles with non-finite or out-of-range parameters.

3. Network Segmentation: Limit exposure of Qt-based applications to untrusted ICC profiles.

4. User Education: Train users not to open ICC profiles from untrusted sources.

5. Monitoring: Deploy the detection rules above to identify exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence