Description
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qtbase-opensource-src | 5.12.5+dfsg-2 | — |
| Debian 14 | qtbase-opensource-src-gles | 5.12.5+dfsg-1 | — |
| Debian 13 | qtbase-opensource-src | 5.12.5+dfsg-2 | — |
| Debian 13 | qtbase-opensource-src-gles | 5.12.5+dfsg-1 | — |
| Debian 12 | qtbase-opensource-src | 5.12.5+dfsg-2 | — |
| Debian 12 | qtbase-opensource-src-gles | 5.12.5+dfsg-1 | — |
| Debian 10 | qtbase-opensource-src | 5.11.3+dfsg1-1+deb10u1 | DSA-4556-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | python-qt5 +4 | 5.13.1-1.el8 | RHSA-2020:1665 |
| RHEL 8 | qgnomeplatform | 0.4-3.el8 | RHSA-2020:1665 |
| RHEL 8 | qt5 +3 | 5.12.5-3.el8 | RHSA-2020:1665 |
| RHEL 8 | qt5-qt3d +2 | 5.12.5-2.el8 | RHSA-2020:1665 |
| RHEL 8 | qt5-qtbase +9 | 5.12.5-4.el8 | RHSA-2020:1665 |
| RHEL 8 | qt5-qtdoc +64 | 5.12.5-1.el8 | RHSA-2020:1665 |
| RHEL 8 | sip +2 | 4.19.19-1.el8 | RHSA-2020:1665 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | python-qt5 | 5.13.1-1.el8 | RLSA-2020:1665 |
| Rocky Linux 8 | qgnomeplatform | 0.4-3.el8 | RLSA-2020:1665 |
| Rocky Linux 8 | qt5 | 5.12.5-3.el8 | RLSA-2020:1665 |
| Rocky Linux 8 | qt5-qt3d | 5.12.5-2.el8 | RLSA-2020:1665 |
| Rocky Linux 8 | qt5-qtdoc +19 | 5.12.5-1.el8 | RLSA-2020:1665 |
Advisories 3
- RHSA-2020:1665 Red Hat Security Advisory: qt5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- DSA-4556-1 qtbase-opensource-src - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:1665 Moderate: qt5 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
References
- https://bugreports.qt.io/browse/QTBUG-77819
- https://codereview.qt-project.org/c/qt/qtbase/+/271889
- https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784
- DSA-4556 vendor-advisory
- 20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update mailing-list
- USN-4275-1 vendor-advisory
- GLSA-202003-60 vendor-advisory