CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-4211 – Improper Link Resolution Before File Access in QFileSystemEngine on Windows
https://notcve.org/view.php?id=CVE-2025-4211
16 May 2025 — Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPath API, which can be exploited by attackers to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation. The affected public API in the Qt Framework is QDir::tempPath() ... • https://codereview.qt-project.org/c/qt/qtbase/+/632231 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-3512 – Buffer overflow in QTextMarkdownImporter
https://notcve.org/view.php?id=CVE-2025-3512
11 Apr 2025 — There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow.This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later. • https://codereview.qt-project.org/c/qt/qtbase/+/635546 • CWE-122: Heap-based Buffer Overflow •