CVE-2025-23050
Low · 3.1CVSS
3.1
EPSS
0.2%
Published
Oct 31, 2025
CISA due date
—
The record
QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Package Hub 15 SP6 | qt6-connectivity | 0 | 6.6.3-bp156.2.3.1 |
| SUSE:Package Hub 15 SP6 | qt6-connectivity-docs | 0 | 6.6.3-bp156.2.3.1 |
| openSUSE:Leap 15.6 | qt6-connectivity | 0 | 6.6.3-bp156.2.3.1 |
| openSUSE:Leap 15.6 | qt6-connectivity-docs | 0 | 6.6.3-bp156.2.3.1 |
| openSUSE:Tumbleweed | libqt5-qtconnectivity | 0 | 5.15.16+kde2-1.1 |
| openSUSE:Tumbleweed | qt6-connectivity | 0 | 6.8.1-2.1 |
Related vulnerabilities
- CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
- CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
- CVE-2026-112896 Pillow is a Python imaging library. CWE-125
- CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125
- CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name… CWE-125
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-125
- CVE-2026-112020 LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in… CWE-125
- CVE-2026-88842 A flaw was found in BusyBox dpkg. CWE-125