CVE-2018-19869

23

FAUCET Score

CVE-2018-19869 is a medium-severity vulnerability affecting Qt versions prior to 5.11.3, including openSUSE and Qt Leap distributions. It involves a segmentation fault in qsvghandler.cpp triggered by a specially crafted SVG image, leading to a denial of service. The attack requires user interaction (e.g., opening a malicious SVG) and has a CVSS score of 6.5. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 5.11.3CPE matchmatch criteria	cpe:2.3:a:qt:qt::::::::
		15.0CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.0:::::::*

CVSS Data

CVSS version used by this source: 3.0

6.5MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

2.20%

Probability of exploitation in next 30 days

EPSS Percentile

80.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0220 is in the 91st percentile among its peer group of 26,234 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (57)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qt3d-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtbase-0:5.9.7-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtcanvas3d-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtconnectivity-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtdeclarative-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtdoc-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtgraphicaleffects-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtimageformats-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtlocation-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtmultimedia-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtquickcontrols-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtquickcontrols2-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtscript-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtsensors-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtserialbus-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtserialport-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtsvg-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qttools-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qttranslations-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtwayland-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtwebchannel-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtwebsockets-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtx11extras-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt5-qtxmlpatterns-0:5.9.7-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: qt-1:4.8.7-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python-qt5-0:5.13.1-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qgnomeplatform-0:0.4-3.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-0:5.12.5-3.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qt3d-0:5.12.5-2.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtbase-0:5.12.5-4.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtcanvas3d-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtconnectivity-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtdeclarative-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtdoc-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtgraphicaleffects-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtimageformats-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtlocation-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtmultimedia-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtquickcontrols-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtquickcontrols2-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtscript-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtsensors-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtserialbus-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtserialport-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtsvg-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qttools-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qttranslations-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtwayland-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtwebchannel-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtwebsockets-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtx11extras-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: qt5-qtxmlpatterns-0:5.12.5-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: sip-0:4.19.19-1.el8

ubuntupatch availablevia ubuntu_usn

Product: qtsvg-opensource-src (bionic)Fixed in: 5.9.5-0ubuntu1.1+esm1

ubuntupatch availablevia ubuntu_usn

Product: qtsvg-opensource-src (focal)Fixed in: 5.12.8-0ubuntu1+esm1

ubuntupatch availablevia ubuntu_usn

Product: qtsvg-opensource-src (jammy)Fixed in: 5.15.3-1ubuntu0.1~esm1

ubuntupatch availablevia ubuntu_usn

Product: qtsvg-opensource-src (xenial)Fixed in: 5.5.1-2ubuntu0.1~esm1

Vendor Advisories (2)

ubuntuUSN-8337-1

QtSvg vulnerabilities

redhatCVE-2018-19869Low

qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service

References

lists.opensuse.org / opensuse-security-announce/2019-04/msg00008.html

Third Party Advisory

lists.opensuse.org / opensuse-security-announce/2020-09/msg00057.html

lists.opensuse.org / opensuse-security-announce/2020-09/msg00071.html

lists.opensuse.org / opensuse-security-announce/2020-09/msg00073.html

lists.opensuse.org / opensuse-security-announce/2020-09/msg00090.html

access.redhat.com / errata/RHSA-2019:2135

blog.qt.io / blog/2018/12/04/qt-5-11-3-released-important-security-updates

Release NotesVendor Advisory

codereview.qt-project.org

Issue TrackingPatchVendor Advisory

lists.debian.org / debian-lts-announce/2019/05/msg00014.html

lists.debian.org / debian-lts-announce/2020/09/msg00023.html

lists.debian.org / debian-lts-announce/2020/10/msg00035.html