CVEvulnerability

CVE-2025-14576

7.4 HIGH Published 2026-04-30 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2026-04-30
Last modified
2026-10-07
Assigner
a59d8014-47c4-4630-ab43-e1b13cbe58e3
CVSS 4.0 (a59d8014-47c4-4630-ab43-e1b13cbe58e3)
7.4 HIGH — CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-94

Description

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

Affected configurations

• qt qtdeclarative (>= 6.8.0 < 6.8.6) • qt qtdeclarative (>= 6.10.0 < 6.10.1)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References