CVE-2025-14576
7.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
Summary
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The Qt Company | Qt | 6.8.0 <= 6.8.6 | affected |
| The Qt Company | Qt | 6.10.0 <= 6.10.1 | affected |
Weaknesses
- CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-20: CWE-20 Improper Input Validation
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file
Additional References
- https://access.redhat.com/security/cve/CVE-2025-14576
- https://bugzilla.redhat.com/show_bug.cgi?id=2464114
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json
- https://access.redhat.com/errata/RHSA-2026:24987
- https://access.redhat.com/errata/RHSA-2026:20567
- https://access.redhat.com/errata/RHSA-2026:7620
- https://access.redhat.com/errata/RHSA-2026:7846
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.