diff --git a/CVE-2025-5455-qtbase-5.15.patch b/CVE-2025-5455-qtbase-5.15.patch
new file mode 100644
index 0000000000000000000000000000000000000000..9cee8646a19ec88d00c8a3434e277ccb2ca82744
--- /dev/null
+++ b/CVE-2025-5455-qtbase-5.15.patch
@@ -0,0 +1,20 @@
+diff --git a/src/corelib/io/qdataurl.cpp b/src/corelib/io/qdataurl.cpp
+index f14d399301f..83e59e3ac00 100644
+--- a/src/corelib/io/qdataurl.cpp
++++ b/src/corelib/io/qdataurl.cpp
+@@ -76,10 +76,11 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const QUrl &uri, QString &mimeType, QByteArray
+         }
+ 
+         if (data.toLower().startsWith("charset")) {
+-            int i = 7;      // strlen("charset")
+-            while (data.at(i) == ' ')
+-                ++i;
+-            if (data.at(i) == '=')
++            int prefixSize = 7; // strlen("charset")
++            QLatin1String copy(data.constData() + prefixSize, data.size() - prefixSize);
++            while (copy.startsWith(QLatin1String(" ")))
++                copy = copy.mid(1);
++            if (copy.startsWith(QLatin1String("=")))
+                 data.prepend("text/plain;");
+         }
+ 
diff --git a/qt5-qtbase.spec b/qt5-qtbase.spec
index c8473ac9099bfa741125e7eb19b69434c082ce91..b9fd28993f45e95b8f4f0a099cefeb810c36f8d6 100644
--- a/qt5-qtbase.spec
+++ b/qt5-qtbase.spec
@@ -34,7 +34,7 @@ BuildRequires:    pkgconfig(libsystemd)
 Name:             qt5-qtbase
 Summary:          Qt5 - QtBase components
 Version:          5.15.2
-Release:          17
+Release:          18
 
 
 # See LGPL_EXCEPTIONS.txt, for exception details
@@ -135,6 +135,7 @@ Patch1001:        1001-add-sw_64-support-for-syscall_fork.patch
 Patch1002:        qtbase5.15-CVE-2023-51714.patch
 Patch1003:        CVE-2023-45935.patch
 Patch1004:        CVE-2025-30348.patch
+Patch1005:        CVE-2025-5455-qtbase-5.15.patch
 
 # Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires.
 # Those themes are there for platform integration. If the required libraries are
@@ -1006,6 +1007,9 @@ fi
 
 
 %changelog
+* Sat Jun 07 2025 Funda Wang <fundawang@yeah.net> - 5.15.2-18
+- fix CVE-2025-5455
+
 * Wed Apr 02 2025 Funda Wang <fundawang@yeah.net> - 5.15.2-17
 - fix CVE-2025-30348