Qt ICNS Image Handling Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Qt versions 6.3.0 prior to 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. The issue arises when a specially crafted ICNS format image file is loaded using QImage, leading to a crash. This vulnerability was introduced in a regression and can be reproduced with a fuzzing tool.

Impact

Exploitation of this vulnerability causes a crash, disrupting the application's normal operation.

Reproduction

The vulnerability can be reproduced by loading a crafted ICNS image file into a Qt application that uses the QImage class to process image data. This can be done using a fuzzing engine like libFuzzer, which has been verified to trigger the crash.

Remediation

Users can upgrade to Qt versions 6.5.10, 6.8.5, or 6.9.1 to address this vulnerability.