Description
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qtbase-opensource-src | 5.12.5+dfsg-8 | — |
| Debian 14 | qtbase-opensource-src-gles | 5.14.2+dfsg-3 | — |
| Debian 13 | qtbase-opensource-src | 5.12.5+dfsg-8 | — |
| Debian 13 | qtbase-opensource-src-gles | 5.14.2+dfsg-3 | — |
| Debian 12 | qtbase-opensource-src | 5.12.5+dfsg-8 | — |
| Debian 12 | qtbase-opensource-src-gles | 5.14.2+dfsg-3 | — |
| Debian 10 | qtbase-opensource-src | 5.11.3+dfsg1-1+deb10u3 | DSA-4617-1 |
| Debian 9 | qtbase-opensource-src | 5.7.1+dfsg-3+deb9u2 | DSA-4617-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +10 | 5.9.2-3.amzn2.0.3 | ALAS2-2020-1543 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | qt5-qtsvg | 5.12.11-3 | — |
Advisories 3
- DSA-4617-1 qtbase-opensource-src - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ALAS2-2020-1543 Moderate: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 3, 2023
- WID-SEC-2023-1748 QT: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jul 13, 2023