CVE-2025-30348
📋 TL;DR
This vulnerability in Qt's QDom XML processing allows an attacker to cause a denial of service through algorithmic complexity attacks. Applications using Qt's XML parsing functionality before version 6.8.0 are affected when processing malicious XML content.
💻 Affected Systems
- Qt framework
- Applications using Qt's XML processing
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash or unresponsive service due to excessive CPU/memory consumption from specially crafted XML input.
Likely Case
Degraded performance or temporary service disruption when processing malicious XML documents.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires crafting specific XML content to trigger the algorithmic complexity issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Qt 6.8.0 or later
Vendor Advisory: https://codereview.qt-project.org/c/qt/qtbase/+/581442
Restart Required: Yes
Instructions:
1. Upgrade Qt to version 6.8.0 or later. 2. Recompile applications with the updated Qt libraries. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize XML input before processing with QDom functions
Resource limiting
allImplement CPU timeouts and memory limits for XML processing operations
🧯 If You Can't Patch
- Implement strict input validation for all XML content
- Deploy XML processing in isolated containers with resource constraints
🔍 How to Verify
Check if Vulnerable:
Check Qt version using qmake --version or examine Qt library filesCheck Version:
qmake --versionVerify Fix Applied:
Verify Qt version is 6.8.0 or later and test XML processing with known problematic inputs📡 Detection & Monitoring
Log Indicators:
- Excessive CPU usage by XML processing tasks
- Application crashes during XML parsing
- Unusually long XML processing times
Network Indicators:
- Large or complex XML payloads to XML endpoints
- Repeated XML submissions to trigger resource exhaustion
SIEM Query:
process_name:application AND (cpu_usage:>90 OR memory_usage:>90) AND command_line:*xml*