LiveActive security incident?Get immediate response
CVE Record

CVE-2021-38593: Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (calle...

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This flaw is a memory-corruption bug in Qt’s graphics rendering code. Applications built with vulnerable Qt versions may be exposed if they process inputs that reach the affected painting path. The provided sources do not establish active exploitation, remote reachability, or business impact.

Executive priority

Treat this as a dependency remediation item with uncertain exploit urgency. Prioritize externally exposed or untrusted-content processing applications first, but do not claim emergency exploitation based on the provided evidence.

Technical view

CVE-2021-38593 is an out-of-bounds write in QOutlineMapper::convertPath, called from QRasterPaintEngine::fill and QPaintEngineEx::stroke. The source bundle lists Qt 5.x before 5.15.6 and Qt 6.x through 6.1.2 as affected. Fix evidence appears in Qt commits and downstream Fedora and Gentoo advisories.

Likely exposure

Exposure is most likely in desktop, embedded, or server-side applications that bundle or dynamically link vulnerable Qt and exercise Qt raster painting or stroke/fill rendering. The sources do not identify specific applications, file formats, or network services.

Exploitation context

No CISA KEV listing is provided, and the bundle does not cite active exploitation. OSS-Fuzz involvement suggests the bug was found through fuzzing, but the sources supplied do not prove a public exploit or practical attack path.

Researcher notes

The key technical evidence is the out-of-bounds write in Qt painting code and three qtbase commits. The supplied data lacks CVSS, CWE, crash details, exploitability assessment, and precise trigger conditions, so validation should focus on version exposure and vendor-fixed builds.

Mitigation direction

  • Inventory applications and packages using Qt 5.x or Qt 6.x.
  • Upgrade Qt 5 builds to 5.15.6 or later where available.
  • Move Qt 6 builds beyond 6.1.2 per vendor guidance.
  • Apply downstream distribution updates from Fedora, Gentoo, or your OS vendor.
  • For bundled Qt, rebuild affected applications with fixed Qt sources.

Validation and detection

  • Check runtime and build-time Qt versions in deployed applications.
  • Review SBOMs for qtbase or Qt framework dependencies.
  • Confirm vendor packages include fixes for CVE-2021-38593.
  • Verify bundled applications were rebuilt after the Qt update.
  • Prioritize apps handling untrusted graphical or document content.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-38593 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.