CVE-2021-38593

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

• CWE-787

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566Issue Tracking, Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yamlThird Party Advisory
• https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862Patch, Third Party Advisory
• https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccdPatch, Third Party Advisory
• https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0cPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/
• https://security.gentoo.org/glsa/202402-03
• https://wiki.qt.io/Qt_5.15_Release#Known_IssuesIssue Tracking, Release Notes, Vendor Advisory
• https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holdersRelease Notes
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566Issue Tracking, Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yamlThird Party Advisory
• https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862Patch, Third Party Advisory
• https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccdPatch, Third Party Advisory
• https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0cPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/
• https://security.gentoo.org/glsa/202402-03
• https://wiki.qt.io/Qt_5.15_Release#Known_IssuesIssue Tracking, Release Notes, Vendor Advisory
• https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holdersRelease Notes

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38588In cPanel before 96.0.13, fix_cpanel_perl lacks verification…8.1
• CVE-2021-38589In cPanel before 96.0.13, scripts/fix-cpanel-perl does not p…8.1
• CVE-2021-3859A flaw was found in Undertow that tripped the client-side in…7.5
• CVE-2021-38590In cPanel before 96.0.8, weak permissions on web stats can l…5.5
• CVE-2021-38591An issue was discovered on LG mobile devices with Android OS…3.3
• CVE-2021-38592Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (…7.5
• CVE-2021-38597wolfSSL before 4.8.1 incorrectly skips OCSP verification in …5.9
• CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.…9.1
• CVE-2021-38599WAL-G before 1.1, when a non-libsodium build (e.g., one of t…7.5
• CVE-2021-3860JFrog Artifactory before 7.25.4 (Enterprise+ deployments onl…8.8
• CVE-2021-38602PluXML 5.8.7 allows Article Editing stored XSS via Headline …4.8
• CVE-2021-38603PluXML 5.8.7 allows core/admin/profil.php stored XSS via the…4.8