Qt5-Based GUI Apps Susceptible to Remote Code Execution

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Forum Veteran
Feb 4, 2016
2,516
15,625
3,578
53
Germany / Poland
Through a little known command line argument, applications that configure custom protocol handlers and are are developed using the Qt5 graphical user interface framework can be exposed to a remote code execution vulnerability.

What many developers don't know is that when you use the Qt5 framework, it also adds command line arguments that can be used to modify how the framework works, such as what window title to show, the size of the window, or even its icon.

These command line arguments are passed to the function that initializes the Qt framework, where they are then parsed as shown below.
... ...
 

You may also like...