CVE-2025-30348: Qt Qt XXE Vulnerability

CVE-2025-30348 Overview

CVE-2025-30348 is an algorithmic complexity vulnerability affecting the encodeText function in QDom, a component of the Qt framework. The vulnerability exists in Qt versions prior to 6.8.0 and involves a complex algorithm for XML string processing that performs inline replacement of string parts with relocation of subsequent data. This inefficient algorithmic approach can be exploited to cause resource exhaustion and denial of service conditions.

Critical Impact

Applications using Qt's QDom XML processing functionality may be vulnerable to denial of service attacks through specially crafted XML input that triggers excessive computational resource consumption.

Affected Products

• Qt versions before 5.15.17
• Qt versions from 6.0.0 before 6.5.8
• Qt versions from 6.6.0 before 6.8.0

Discovery Timeline

• 2025-03-21 - CVE-2025-30348 published to NVD
• 2025-03-24 - Last updated in NVD database

Technical Details for CVE-2025-30348

Vulnerability Analysis

The vulnerability resides in the encodeText function within QDom, Qt's Document Object Model implementation for XML processing. The function employs a complex algorithm that performs XML string copy operations combined with inline replacement of string segments. When replacements occur, the algorithm relocates subsequent data within the string, creating an inefficient processing pattern.

This implementation approach leads to CWE-407: Inefficient Algorithmic Complexity. When processing carefully crafted XML input, the algorithm can exhibit quadratic or worse time complexity, causing significant CPU resource consumption. An attacker can exploit this by submitting XML data designed to maximize the number of inline replacements and data relocations, effectively creating a denial of service condition.

The network-accessible nature of this vulnerability means that any application exposing Qt-based XML parsing functionality to external input could be affected. No authentication is required to exploit this vulnerability, and no user interaction is necessary.

Root Cause

The root cause of CVE-2025-30348 is the inefficient algorithmic design in the encodeText function. Rather than using an optimized string building approach that would achieve linear time complexity, the implementation performs repeated inline modifications with data relocation. Each replacement operation potentially requires moving all subsequent characters in the string, leading to algorithmic complexity that can be exploited for resource exhaustion attacks.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by sending specially crafted XML data to an application that processes it using Qt's QDom functionality. The malicious input would be designed to maximize the number of text encoding operations and string relocations, causing the encodeText function to consume excessive CPU cycles.

Since the vulnerability requires no privileges and no user interaction, any network-exposed service using vulnerable Qt versions for XML processing represents a potential target. The attack results in availability impact through resource exhaustion, though no confidentiality or integrity compromise occurs.

Detection Methods for CVE-2025-30348

Indicators of Compromise

• Unusual CPU spikes during XML processing operations
• Increased processing time for XML parsing tasks in Qt-based applications
• Application unresponsiveness when handling XML input
• Memory consumption anomalies in processes utilizing QDom functionality

Detection Strategies

• Monitor CPU utilization patterns for Qt-based applications processing XML data
• Implement input size limits and timeouts for XML parsing operations
• Enable application performance monitoring to detect algorithmic complexity attacks
• Review application logs for extended XML processing durations

Monitoring Recommendations

• Configure alerts for abnormal resource consumption in Qt-based services
• Implement request rate limiting for endpoints accepting XML input
• Monitor thread pool exhaustion in applications using QDom
• Track XML parsing operation durations as a baseline for anomaly detection

How to Mitigate CVE-2025-30348

Immediate Actions Required

• Upgrade Qt to version 6.8.0 or later for affected 6.x installations
• Upgrade Qt to version 6.5.8 or later for 6.5.x branch installations
• Upgrade Qt to version 5.15.17 or later for 5.x installations
• Implement input validation and size limits for XML data before processing

Patch Information

Qt has released patches addressing this algorithmic complexity issue. The fix is available through the Qt Project Code Review. Organizations should update to the following patched versions:

• Qt 5.15.17 or later for the 5.x branch
• Qt 6.5.8 or later for the 6.5.x branch
• Qt 6.8.0 or later for newer 6.x installations

Workarounds

• Implement strict XML input size limits to reduce attack surface
• Add processing timeouts for XML parsing operations
• Consider using alternative XML parsing libraries for high-risk input sources
• Deploy network-level rate limiting for services accepting XML input

# Example: Setting resource limits for Qt applications on Linux
# Limit CPU time to prevent runaway processing
ulimit -t 60

# Or configure via systemd service unit
# Add to [Service] section:
# CPUQuota=50%
# TimeoutSec=30