Description
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 26.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 25.10 | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 24.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 22.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | qtbase-opensource-src | 5.12.8+dfsg-0ubuntu2.1 | — |
| Ubuntu 20.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
| Ubuntu 18.04 LTS | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.6 | USN-5081-1 |
| Ubuntu 16.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | qt5-qtbase +9 | 5.15.2-4.el8 | RHSA-2022:1796 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | qt5-qtbase +9 | 5.15.2-4.el8 | ALSA-2022:1796 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | qt5-qtbase | 5.15.2-4.el8 | RLSA-2022:1796 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +10 | 5.9.2-3.amzn2.0.5 | ALAS2-2023-1967 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | qt5-qtbase | 5.12.11-11 | — |
| Azure Linux 2 (CBL-Mariner) | qt5-qtsvg | 5.12.11-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | qt5-qtbase +9 | 5.15.2-4.el8 | ELSA-2022-1796 |
Advisories 7
- ALSA-2022:1796 Moderate: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:1796 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5081-1 qtbase-opensource-src vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RLSA-2022:1796 Moderate: qt5-qtbase security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2022-0610 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 4, 2024
- ALAS2-2023-1967 Moderate: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2023
- ELSA-2022-1796 Moderate: qt5-qtbase security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
References
- https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c
- https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd
- https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml
- https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
- https://wiki.qt.io/Qt_5.15_Release#Known_Issues
- FEDORA-2022-54760f7fa4 vendor-advisory
- FEDORA-2022-4131ced81a vendor-advisory
- GLSA-202402-03 vendor-advisory