How severe is CVE-2025-6338?

CVE-2025-6338 has a CVSS 4.0 base score of 9.2, rated critical severity.

Is CVE-2025-6338 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-6338?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-6338 have an EU (EUVD) identifier?

Yes. CVE-2025-6338 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34743.

When was CVE-2025-6338 published?

CVE-2025-6338 was published on 2025-10-16 and last updated on 2026-06-17.

CVE-2025-6338

CVE-2025-6338 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-459.

Key facts

Severity: Critical (CVSS 4.0 base score 9.2)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34743
Weakness: CWE-459
Published: 2025-10-16
Last modified: 2026-06-17

Description

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.

Frequently asked questions

What is CVE-2025-6338?: There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.
How severe is CVE-2025-6338?: CVE-2025-6338 has a CVSS 4.0 base score of 9.2, rated critical severity.
Is CVE-2025-6338 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-6338?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-6338 have an EU (EUVD) identifier?: Yes. CVE-2025-6338 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34743.
When was CVE-2025-6338 published?: CVE-2025-6338 was published on 2025-10-16 and last updated on 2026-06-17.

References

https://codereview.qt-project.org/c/qt/qtbase/+/651495

Other CWE-459 vulnerabilities

CVE-2023-36468 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki…
CVE-2022-45347 — Critical (CVSS 9.8): Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session…
CVE-2021-45330 — Critical (CVSS 9.8): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies…
CVE-2021-45706 — Critical (CVSS 9.8): An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
CVE-2021-32928 — Critical (CVSS 9.8): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License…
CVE-2020-13451 — Critical (CVSS 9.8): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to…

Browse all CWE-459 vulnerabilities →