CVE-2024-30161: Qt WebAssembly Use-After-Free Vulnerability

CVE-2024-30161 Overview

CVE-2024-30161 is a use-after-free vulnerability in the Qt framework affecting WebAssembly builds. The flaw resides in QNetworkReply header handling within Qt for WebAssembly (wasm). An attacker can access header data through a dangling pointer, leading to information exposure or integrity impact. The issue affects Qt versions 6.5.4, 6.5.5, and 6.6.2 specifically. Earlier and later releases are not impacted. The vulnerability is tracked under CWE-416 (Use After Free).

Critical Impact
Attackers can access QNetworkReply header data via a dangling pointer in Qt for WebAssembly, enabling information disclosure and potential data tampering in affected Qt applications compiled to wasm.

Affected Products

Qt 6.5.4
Qt 6.5.5
Qt 6.6.2

Discovery Timeline

2024-03-24 - CVE-2024-30161 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30161

Vulnerability Analysis

The vulnerability affects the QNetworkReply class when Qt is compiled for the WebAssembly target. QNetworkReply exposes HTTP response headers to application code through its public API. In the affected wasm backend, the underlying header storage is released while a pointer referencing that memory remains in use. Subsequent reads through this dangling pointer return data from freed memory.

Use-after-free conditions in network response handling can expose adjacent heap contents to the calling code. In a WebAssembly runtime, this exposure is bounded by the linear memory sandbox but still allows disclosure of application-level secrets and integrity violations within the module. Qt applications ported to the browser that handle authenticated requests are the primary concern.

Root Cause

The root cause is incorrect object lifetime management in the Qt WebAssembly network backend. Header data owned by the reply object is deallocated before all references to it are released. The vendor fix is tracked in the Qt Project Code Review, which corrects the ownership and lifetime of the header storage so that pointers do not outlive the backing memory.

Attack Vector

Exploitation requires that a Qt wasm application process attacker-influenced network responses. An attacker who controls or tampers with HTTP responses observed by the vulnerable client can trigger the dangling pointer access path. No user interaction or authentication is required at the application layer. The attack is network-reachable because the trigger is delivered through standard HTTP response handling.

No public proof-of-concept exploit code is available for this issue. Technical reproduction details are documented in the vendor patch referenced above.

Detection Methods for CVE-2024-30161

Indicators of Compromise

Qt-based WebAssembly applications linked against Qt 6.5.4, 6.5.5, or 6.6.2 serving in browser contexts
Anomalous or corrupted header values surfaced by Qt wasm clients, including unexpected binary content in header fields
Crashes or memory faults in wasm modules correlated with QNetworkReply header reads

Detection Strategies

Inventory build artifacts and dependency manifests to identify Qt wasm binaries pinned to affected versions
Review CMakeLists.txt, qmake project files, and CI pipelines for references to Qt 6.5.4, 6.5.5, or 6.6.2
Scan hosted web assets for Qt wasm bundles using version strings embedded in .wasm or .js loader files

Monitoring Recommendations

Monitor web application telemetry for client-side exceptions originating from Qt wasm modules handling network replies
Track outbound requests from Qt wasm clients to detect unexpected endpoints that could deliver crafted responses
Enforce strict Content Security Policy and Subresource Integrity to limit attacker control over response bodies loaded by Qt wasm applications

How to Mitigate CVE-2024-30161

Immediate Actions Required

Upgrade Qt to a version outside the affected range, moving beyond 6.6.2 to the latest supported 6.6.x or 6.7.x release
Rebuild and redeploy any WebAssembly artifacts produced with the vulnerable Qt versions
Audit third-party Qt wasm components bundled with your applications and request updated builds from vendors

Patch Information

The Qt Project addressed the issue in the qtbase repository. Review the fix and associated commit history in the Qt Project Code Review. After applying the patched source, recompile the WebAssembly target and publish the rebuilt bundle. Confirm the deployed version string reflects a non-affected release.

Workarounds

Pin production builds to Qt 6.5.3 or earlier within the 6.5.x series until an upgrade path is available
Restrict Qt wasm clients to trusted backends using TLS pinning and strict origin controls to reduce attacker-controlled response exposure
Avoid caching or reusing QNetworkReply header references across asynchronous callbacks in application code targeting wasm

bash

# Verify Qt version used in a WebAssembly build
strings app.wasm | grep -i "Qt 6\."

# Example CMake pin to a non-affected Qt release
find_package(Qt6 6.7.0 REQUIRED COMPONENTS Core Network)