External risk intelligence

Qt Network Schannel Denial of Service Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-6338

The vulnerability affects Qt Network's Schannel support, a library component. While it may be utilized in internet-facing applications, its presence does not inherently guarantee public exposure. Reachability depends entirely on how developers implement the library within specific applications, making internet exposure possible but not a standard or universal deployment pattern.

Denial of Service

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Qt's Schannel support on Windows that, if exploited, could lead to a prolonged denial-of-service condition. While the technical details involve incomplete cleanup, the high-level concern is a potential disruption to services that rely on this specific networking component. The main implication for leadership is to understand if and how this technology is used within the organization's product portfolio.

Issue: A flaw in network code can cause service disruptions.
Why remember: Potential for long-term denial of service.
Executive takeaway: Confirm if the technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to an application that uses Qt's Schannel support. This exposure, over the network without any authentication or user interaction, could lead to a prolonged denial of service.

No special access required.
Triggered by network traffic.
Causes denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the availability of applications utilizing Qt Network's Schannel support on Windows. When supported by the advisory, prolonged exploitation may lead to denial of service by consuming system resources.

Application availability.
Incomplete resource cleanup.
Prolonged denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Qt Network's Schannel support requires careful triage by teams responsible for applications utilizing this component. The first practical step is to identify all instances of the affected Qt versions, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application and platform teams own remediation.
Verify internet-facing and critical deployments.
Plan maintenance for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Qt Network and why does it use Schannel?

Qt Network is a core module in the Qt application framework that allows developers to create software capable of network communication. On Windows, it leverages Schannel (Secure Channel), which is the native Windows security package for handling SSL and TLS encryption. Developers use this integration so their applications can establish secure, encrypted connections using standard Windows cryptographic services rather than building their own security layers from scratch.

What does incomplete cleanup mean for CVE-2025-6338?

This vulnerability, classified as CWE-459 (Incomplete Cleanup), means the software fails to properly release or reset system resources—such as memory or connection handles—after finishing a network task. In CVE-2025-6338, these resources remain 'in use' indefinitely. Over time, as an application repeatedly handles network traffic, these leaked resources accumulate until the application can no longer function, resulting in a denial-of-service condition.

How is this Denial of Service triggered?

The issue is triggered when an application receives specifically crafted network traffic that interacts with the flawed Schannel handling logic. It does not require a single 'malicious' packet to crash the system instantly; rather, the vulnerability is triggered by the cumulative effect of these requests. Normal, legitimate network traffic that does not exercise the problematic cleanup path will not trigger this resource exhaustion.

Do I need to worry if my application is internal?

Halo Surface Signal indicates that while this vulnerability is reachable via the network, its impact depends on whether the application is exposed. Internet-facing applications are at higher risk because they are accessible to anyone; however, internal applications are not immune. If an internal service processes untrusted data from the network, it could still be targeted. You must assess whether your specific deployment architecture allows network-based interaction.

What is the first step to address CVE-2025-6338?

Your first step is to perform an inventory of your software portfolio to identify which applications use Qt versions 5.15.0 through 6.8.3 or 6.9.0 through 6.9.1 on Windows. Once identified, prioritize these applications based on their business criticality and whether they accept network traffic. Assign these findings to your application teams to verify the presence of the affected library and plan for necessary updates or maintenance.

References

codereview.qt-project.org/c/qt/qtbase/+/651495

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.