Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)
ALSA-2026:96075 updates qt5-qtdeclarative on AlmaLinux 8, fixing CVE-2025-12385 — improper validation of the tag size in the Text component parser (CVSS 8.7). Update with dnf update qt5-qtdeclarative and restart applications linking Qt declarative components.
What this means under a SharedLicense license
Improper tag-size validation in the Text parser is reachable by crafted QML/content — memory corruption class flaws there crash or compromise applications rendering untrusted text.
Type:
security
Severity:
important
Release date:
2026-11-10
Description:
Qt5 – QtDeclarative component.
Security Fix(es):
* qt5-qtdeclarative: qt6-qtdeclarative: Improper validation of tag size in Text component parser (CVE-2025-12385)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | qt5-qtdeclarative-5.15.3-3.el8_10.aarch64.rpm | 37baa3c435d26a3d8ac82290ac3f73888004283297e55cd65f4274dd23a12930 |
| aarch64 | qt5-qtdeclarative-static-5.15.3-3.el8_10.aarch64.rpm | 6e688d7cc530b9036a92ef5844e5875b4e76778fa48bdffecf08edb0b2cf8aea |
| aarch64 | qt5-qtdeclarative-devel-5.15.3-3.el8_10.aarch64.rpm | 8ecb59d8caeb9b43e78ff5a3580df0fe2f13a7cb1f290275d600e4c8fa11bc4f |
| aarch64 | qt5-qtdeclarative-examples-5.15.3-3.el8_10.aarch64.rpm | ca5e0effa822d772f3b8975a455621df684dabcb88d1f37351e877b2cb992980 |
| i686 | qt5-qtdeclarative-5.15.3-3.el8_10.i686.rpm | 214474b16e046f8e6713da96c16a60e543583a7b4825c25ed91c0a1bebd99514 |
| i686 | qt5-qtdeclarative-static-5.15.3-3.el8_10.i686.rpm | 664ad2bc738b92915b530d96fffceadd11651e9975ad2cbbf4571cde9d94012d |
| i686 | qt5-qtdeclarative-devel-5.15.3-3.el8_10.i686.rpm | d918a274578ac80026f8d1732be6840b6d6559756ae0e96c66605732941552fe |
| ppc64le | qt5-qtdeclarative-static-5.15.3-3.el8_10.ppc64le.rpm | 0d877e64999f16b44bb79d111927a2aba1d9d663bbd33cd3e79a60b804d6fc17 |
| ppc64le | qt5-qtdeclarative-5.15.3-3.el8_10.ppc64le.rpm | 318eb11356b844c81da71fa9ead616dce4cc21f55b4d6ab1d8133964498170b6 |
| ppc64le | qt5-qtdeclarative-examples-5.15.3-3.el8_10.ppc64le.rpm | 93228b589de1488c350be07dc40305b6f74205ec99020ad5009917048c1d4362 |
| ppc64le | qt5-qtdeclarative-devel-5.15.3-3.el8_10.ppc64le.rpm | d96baa13a7b61a403ccafbf26ce709bca86936d48cf06bdbb6233177e94184f9 |
| s390x | qt5-qtdeclarative-static-5.15.3-3.el8_10.s390x.rpm | 4f9388db523db9965f0d5a33d9dda716083611593d3ab923f35925db621fd5ea |
| s390x | qt5-qtdeclarative-examples-5.15.3-3.el8_10.s390x.rpm | 62b94615de71d35d2f83839bd2c3eb6a89f32edfa6f5c0f681d4caa330772af8 |
| s390x | qt5-qtdeclarative-5.15.3-3.el8_10.s390x.rpm | 9a65db258296042809b7fc6529013f7afd3fc6113c6df699c068f7245a40db9b |
| s390x | qt5-qtdeclarative-devel-5.15.3-3.el8_10.s390x.rpm | b77c2599cc2055635bfa1ea4d0710d98e6a77bfb1ba5a0986ac785e89d81a1fc |
| x86_64 | qt5-qtdeclarative-devel-5.15.3-3.el8_10.x86_64.rpm | 3547486463105453371755b2c9064b6a427f1a4f0d8b2e3ee07dbc83d92945a2 |
| x86_64 | qt5-qtdeclarative-examples-5.15.3-3.el8_10.x86_64.rpm | b2a3aab85664e3e1aee15f688165c77448794671a20d2b284dc07975cfa33103 |
| x86_64 | qt5-qtdeclarative-static-5.15.3-3.el8_10.x86_64.rpm | d49dae50a2b39b211bd278a841c5c89e23133e61dbd2c59dfd5de9ac4f231852 |
| x86_64 | qt5-qtdeclarative-5.15.3-3.el8_10.x86_64.rpm | fe0c3eb0db5aefe9c0cff1b3128558c8067c502bd36dc63372a325756f575aed |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Frequently Asked Questions
What is CVE-2025-12385?
Who is affected?
How do I apply the fix?
Why does a GUI library matter on servers?
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System