CVE-2025-10728
published 2025-10-03CVE-2025-10728: When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
PriorityP344critical9.4CVSS 4.0
AVLACLATNPRNUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSPAUXRXVXREHURed
EPSS
0.20%
10.4th percentile
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qt6-svg | < qt6-svg 6.9.2-3 (forky) | qt6-svg 6.9.2-3 (forky) |
| debian | qtsvg-opensource-src | < qt6-svg 6.9.2-3 (forky) | qt6-svg 6.9.2-3 (forky) |
| msrc | azl3_qtsvg_6.6.1-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_qt5-qtsvg_5.12.11-6_on_cbl_mariner_2.0 | — | — |
| the_qt_company | qt | 6.7.0 – 6.8.4 | — |
| the_qt_company | qt | 6.9.0 – 6.9.2 | — |
CVSS provenance
nvdv4.09.4CRITICALCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red
osv9.4CRITICAL
vendor_debian9.4LOW
vendor_msrc9.4HIGH
vendor_redhat9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Uncontrolled recursion in Qt SVG module
vendor_msrc·2025-10-14·CVSS 9.4
CVE-2025-10728 [CRITICAL] CWE-674 Uncontrolled recursion in Qt SVG module
Uncontrolled recursion in Qt SVG module
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
TQtC: TQtC
Customer Action Required: Yes
Red Hat
qtsvg: Uncontrolled recursion in Qt SVG module
vendor_redhat·2025-10-03·CVSS 9.4
CVE-2025-10728 [CRITICAL] CWE-674 qtsvg: Uncontrolled recursion in Qt SVG module
qtsvg: Uncontrolled recursion in Qt SVG module
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
A stack overflow flaw has been discovered in the Qt SVG module. When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
Statement: The only discussed impact is to program availability. It is unclear why the upstream advisory indicates confidentiality and integrity impact.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: qt5-qtsvg (Red
Debian
CVE-2025-10728: qt6-svg - When the module renders a Svg file that contains a <pattern> element, it might e...
vendor_debian·2025·CVSS 9.4
CVE-2025-10728 [CRITICAL] CVE-2025-10728: qt6-svg - When the module renders a Svg file that contains a <pattern> element, it might e...
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
Scope: local
bookworm: resolved
forky: resolved (fixed in 6.9.2-3)
sid: resolved (fixed in 6.9.2-3)
trixie: open
GHSA
GHSA-x6f6-j278-6544: When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
ghsa_unreviewed·2025-10-03
CVE-2025-10728 [CRITICAL] CWE-674 GHSA-x6f6-j278-6544: When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
OSV
CVE-2025-10728: When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
osv·2025-10-03·CVSS 9.4
CVE-2025-10728 [CRITICAL] CVE-2025-10728: When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
blogs_bleepingcomputer·2025-10-14·CVSS 7.8
[HIGH] Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Lawrence Abrams
80 Elevation of Privilege Vulnerabilities
11 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
28 Information Disclosure Vulnerabilities
11 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released today by Microsoft. Therefore, the number of flaws does not include those fixed in Azure, Mariner, Microsoft Edge, and other vulnerabilities earlier this month.
Notably, Windows 10 reaches the end of support today , with this being the last Patch Tuesday where Microsoft provides free security updates to the venerable operating system.
To continue receiving security upd
Bugzilla
CVE-2025-10728 qtsvg: Uncontrolled recursion in Qt SVG module
bugzilla·2025-10-03·CVSS 9.4
CVE-2025-10728 [CRITICAL] CVE-2025-10728 qtsvg: Uncontrolled recursion in Qt SVG module
CVE-2025-10728 qtsvg: Uncontrolled recursion in Qt SVG module
When the module renders a Svg file that contains a element, it might end up rendering it recursively leading to stack overflow DoS
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10.0 Extended Update Support
Via RHSA-2025:22393 https://access.redhat.com/errata/RHSA-2025:22393
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:22394 https://access.redhat.com/errata/RHSA-2025:22394
2025-10-03
Published