CVE-2019-18281: Debian Linux

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Qt Qtbase: from 5.11.0, up to and including 5.11.3; from 5.12.0, before 5.12.5 (fixed in 5.12.5)

Published 2019-10-23. Last modified 2026-06-17.