CVE-2019-18281

An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/qt/qtbase

Affected ranges

Type

GIT

Repo

https://github.com/qt/qtbase

Events

Introduced

6eef81ee1c82f934e14d47047d8b6103b8755321

Last affected

08de243eaa007597c2bfbc97d3d14e2f821ac4be

Introduced

13ed06640c6cf32ea8c784c896c6bf017053edb3

Fixed

abfb1b8665923ce2824392f3a04e5e4ac3871017

Database specific

{
    "extracted_events": [
        {
            "introduced": "5.11.0"
        },
        {
            "last_affected": "5.11.3"
        },
        {
            "introduced": "5.12.0"
        },
        {
            "fixed": "5.12.5"
        }
    ],
    "cpe": "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Database specific

vanir_signatures_modified

"2026-07-08T17:16:56Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18281.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "target": {
            "file": "qmake/generators/mac/pbuilder_pbx.cpp"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "42175485319852982382716562530548920112",
                "269969189790789914493321821784506182077",
                "192896421012310542730988811461340756350",
                "81493618896476637973500433905196848195",
                "177778031528303863734575949352642260045",
                "204261337458403320614169416449406855994",
                "282401848054897177864544170876498713116",
                "23956863597407661719760492111577731941",
                "120874335481434784682992640334932410074"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2019-18281-ce26650f",
        "source": "https://github.com/qt/qtbase/commit/abfb1b8665923ce2824392f3a04e5e4ac3871017",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "qmake/generators/mac/pbuilder_pbx.cpp",
            "function": "ProjectBuilderMakefileGenerator::writeMakeParts"
        },
        "deprecated": false,
        "digest": {
            "length": 55991.0,
            "function_hash": "55318626890648757947913378382764058604"
        },
        "id": "CVE-2019-18281-f29a5ae7",
        "source": "https://github.com/qt/qtbase/commit/abfb1b8665923ce2824392f3a04e5e4ac3871017",
        "signature_version": "v1"
    }
]