Medium
Security advisory
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-45930
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:40 UTC · Revision 1
Source evidence
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
osv:CVE-2021-45930
Complete source record
{
"id": "10a6e51385e84ffabc048de9f15deabe727d217f6a8218b5de5968dd85667add",
"url": "https://osv.dev/vulnerability/CVE-2021-45930",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-45930",
"summary": "Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).",
"evidence": "osv:CVE-2021-45930",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-45930",
"aliases": [
"CVE-2021-45930"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/qt/qtsvg",
"type": "GIT",
"events": [
{
"introduced": "74a697a8eb7de89184a71aaefd08747e5172ca0e"
},
{
"last_affected": "52d3788c7b0116ea3db232dccca5f1e3f1e229ac"
},
{
"introduced": "608054063bf58c555a1871e0a4df9c329c3b6885"
},
{
"last_affected": "bb5a847d9b2f388aa348bdd3158b125a77091ccf"
},
{
"fixed": "36cfd9efb9b22b891adee9c48d30202289cfa620"
},
{
"fixed": "79bb9f51fa374106a612d17c9d98d35d807be670"
},
{
"fixed": "a3b753c2d077313fc9eb93af547051b956e383fc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:qt:qtsvg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.15.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:qt:qtsvg:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.2.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "36cfd9efb9b22b891adee9c48d30202289cfa620"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "79bb9f51fa374106a612d17c9d98d35d807be670"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a3b753c2d077313fc9eb93af547051b956e383fc"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-45930.json",
"vanir_signatures": [
{
"id": "CVE-2021-45930-0fea7f14",
"digest": {
"length": 5873,
"function_hash": "237349539407575290880165639091044829427"
},
"source": "https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "parsePathDataFast"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-18e3276b",
"digest": {
"length": 260,
"function_hash": "22664460336088048164437824955174280066"
},
"source": "https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "createPathNode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-20d9e9f7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62683293538356366748123422538084217604",
"66259520355073571974342431275235430189",
"330224351067661547045579550938858433669",
"110851679110151133861223839420494309423",
"215454757397286929716735354875114683246",
"114884599593155944999091413780464446843",
"208558297433289897690124428174953419346",
"179268040380559443082363488129284914622",
"64319606297248230794059766133771798803",
"167032248842890905591528196233980395029",
"140604476628133985858706767355743889658",
"1496629106554835914626975465927735289",
"219256068205569700031767260704901191728",
"28494924413591835249560458255879590779",
"69407597335676739159879707814264961694",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"339596664257191267722872952223172263076",
"44320716376878989246742065529162458367",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"301811181267095201939078654247003510524",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"125788091830926688034764237752563702146",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"149709696143292960057714479729443117301",
"26532945151594929964035866101628427945",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"135748082914709724224352386680676508086",
"339667329338441134012774610423829264636",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"31061021584562936639185440926858273732",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"131979474583978373630649198991169030283",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"271680698471822557749206618476653062023",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"101559039777602742662431053309702108601",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"141288904807226363073481694910960771016",
"42552037155200148502408219696879250068",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"206399918618874779654892124208642325338",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"37415825601299739301022543248796799547",
"222981842113018445298086962150850787644",
"28550261148651499783966605397172598240",
"159706180438932497076395068148059282544",
"146422478395764458307082448962084349444",
"14361478919370886827362222805788100087",
"63023319149774050960125992398873200987",
"283686758500405964024605018375197700160",
"328651234607113341419988316569677492639",
"193125009705975087920846422117195891995",
"88596955835527071135212605830406634567",
"136103620622345213203529501669113161403",
"201066770680636281209966811495181190668"
]
},
"source": "https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc",
"target": {
"file": "src/svg/qsvghandler.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-2747882f",
"digest": {
"length": 5764,
"function_hash": "56913924235923864717652985139580490079"
},
"source": "https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "parsePathDataFast"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-42719e69",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127495365576937852473836295686895347211",
"286293394187639868897133649366840211154",
"55160838619000306101708044850552802525",
"110851679110151133861223839420494309423",
"215454757397286929716735354875114683246",
"114884599593155944999091413780464446843",
"208558297433289897690124428174953419346",
"179268040380559443082363488129284914622",
"64319606297248230794059766133771798803",
"167032248842890905591528196233980395029",
"140604476628133985858706767355743889658",
"1496629106554835914626975465927735289",
"219256068205569700031767260704901191728",
"28494924413591835249560458255879590779",
"69407597335676739159879707814264961694",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"339596664257191267722872952223172263076",
"44320716376878989246742065529162458367",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"301811181267095201939078654247003510524",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"125788091830926688034764237752563702146",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"149709696143292960057714479729443117301",
"26532945151594929964035866101628427945",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"135748082914709724224352386680676508086",
"339667329338441134012774610423829264636",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"31061021584562936639185440926858273732",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"131979474583978373630649198991169030283",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"271680698471822557749206618476653062023",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"101559039777602742662431053309702108601",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"141288904807226363073481694910960771016",
"42552037155200148502408219696879250068",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"206399918618874779654892124208642325338",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"37415825601299739301022543248796799547",
"222981842113018445298086962150850787644",
"28550261148651499783966605397172598240",
"159706180438932497076395068148059282544",
"146422478395764458307082448962084349444",
"14361478919370886827362222805788100087",
"63023319149774050960125992398873200987",
"283686758500405964024605018375197700160",
"328651234607113341419988316569677492639",
"190447244031680060797438872700384565326",
"88596955835527071135212605830406634567",
"136103620622345213203529501669113161403",
"201066770680636281209966811495181190668"
]
},
"source": "https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670",
"target": {
"file": "src/svg/qsvghandler.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-57d5d4f5",
"digest": {
"length": 260,
"function_hash": "22664460336088048164437824955174280066"
},
"source": "https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "createPathNode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-dd3a5515",
"digest": {
"length": 260,
"function_hash": "22664460336088048164437824955174280066"
},
"source": "https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "createPathNode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-e9a0e360",
"digest": {
"threshold": 0.9,
"line_hashes": [
"127495365576937852473836295686895347211",
"286293394187639868897133649366840211154",
"55160838619000306101708044850552802525",
"110851679110151133861223839420494309423",
"215454757397286929716735354875114683246",
"114884599593155944999091413780464446843",
"208558297433289897690124428174953419346",
"179268040380559443082363488129284914622",
"64319606297248230794059766133771798803",
"167032248842890905591528196233980395029",
"140604476628133985858706767355743889658",
"1496629106554835914626975465927735289",
"219256068205569700031767260704901191728",
"28494924413591835249560458255879590779",
"69407597335676739159879707814264961694",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"339596664257191267722872952223172263076",
"44320716376878989246742065529162458367",
"309940502325702528349127477868299246959",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"301811181267095201939078654247003510524",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"125788091830926688034764237752563702146",
"189248914398341833641583734880569964238",
"38334896828802863984929670564488527150",
"139338491125812018420114515857084738230",
"114072514639913029123742381383824290546",
"149709696143292960057714479729443117301",
"26532945151594929964035866101628427945",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"135748082914709724224352386680676508086",
"339667329338441134012774610423829264636",
"280766332294752593408667512002073883353",
"14687872647738751654166662726185135125",
"249743739296070218436040918197221225818",
"31061021584562936639185440926858273732",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"329619933089236639085477289080254124299",
"190836690225213081664322269023390753497",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"317270552589464407342391542786580668482",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"131979474583978373630649198991169030283",
"281191177125636076313681269636381330013",
"318461119142054349169011400744258778974",
"317489081648720578814488109384655178821",
"249743739296070218436040918197221225818",
"271680698471822557749206618476653062023",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"101559039777602742662431053309702108601",
"209651465273758744949563953811784269145",
"271287268210858219157090522421432546386",
"68649812678940130784158202311198330589",
"249743739296070218436040918197221225818",
"141288904807226363073481694910960771016",
"42552037155200148502408219696879250068",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"206399918618874779654892124208642325338",
"89796763875206234747672140893896603246",
"27412886011935800042331465813199423554",
"249743739296070218436040918197221225818",
"162457162237985926720917454271077485016",
"37415825601299739301022543248796799547",
"222981842113018445298086962150850787644",
"28550261148651499783966605397172598240",
"159706180438932497076395068148059282544",
"146422478395764458307082448962084349444",
"14361478919370886827362222805788100087",
"63023319149774050960125992398873200987",
"283686758500405964024605018375197700160",
"328651234607113341419988316569677492639",
"190447244031680060797438872700384565326",
"88596955835527071135212605830406634567",
"136103620622345213203529501669113161403",
"201066770680636281209966811495181190668"
]
},
"source": "https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620",
"target": {
"file": "src/svg/qsvghandler.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-45930-f48991b4",
"digest": {
"length": 5873,
"function_hash": "237349539407575290880165639091044829427"
},
"source": "https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620",
"target": {
"file": "src/svg/qsvghandler.cpp",
"function": "parsePathDataFast"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:10:56Z"
}
}
],
"modified": "2026-10-20T14:10:56.738896993Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GKOKVCSDZSOWWR3HOW5XUIUJC4MKQY5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZIXNSX7FV733TWTTLY6FHSH3SCNQKKD/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V75XNX4GDB64N5BSOAN474RUXXS5OHRU/",
"https://lists.debian.org/debian-lts-announce/2022/01/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2022/01/msg00022.html",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306",
"https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620",
"https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670",
"https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc",
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "34"
},
{
"last_affected": "34"
},
{
"introduced": "35"
},
{
"last_affected": "35"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-45930",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388680,
"published_at": "2022-01-01T01:15:08.42+00:00"
}