Critical XML String Manipulation Vulnerability in qt6-base Package
Summary
CVE-2025-30348: encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data). Affects qt6-base versions >= 33f5e985e480283bb0ca9dea5f82643e825ba87c, < b839e9b36db3a4e50dfb34521d8ef8de1fd01969. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qt6-base package is a core component of the Qt framework, which is widely used for developing cross-platform applications with a graphical user interface. This package provides essential functionalities for handling XML data, among other features. However, prior to version 6.8.0, it contains a vulnerability in the encodeText function of QDom that can lead to potential security risks when processing XML strings.
Vulnerability Detail
The vulnerability, identified as CVE-2025-30348, arises from a complex algorithm in the encodeText function that involves copying XML strings and inline replacement of string parts. This can lead to unexpected behavior, including potential data corruption or exploitation by attackers to manipulate XML data. The issue is particularly concerning as it may allow for unauthorized access or modification of sensitive information within applications that rely on the affected version of the qt6-base package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the encodeText function in your application until the package is updated. Review your XML handling code to ensure that it does not rely on potentially vulnerable string manipulation methods.
Conclusion
The CVE-2025-30348 vulnerability in the qt6-base package poses significant risks related to XML string manipulation. It is crucial for developers to update their packages to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for qt6-base →
FAQ
CVE-2025-30348 is a vulnerability in the qt6-base package that affects the encodeText function in QDom, leading to potential XML string manipulation issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include data corruption and potential exploitation by attackers to manipulate XML data, which could lead to unauthorized access to sensitive information.
Yes, a patched version of the qt6-base package is available. For Debian 13, update to version 6.8.2+dfsg-5 or later.
If an immediate update is not possible, consider implementing workarounds such as avoiding the use of the encodeText function in your application.
Related vulnerabilities
Recent vulnerabilities recorded for qt6-base.
