CVE-2025-14576: Possible QML code injection in VectorImage component
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 6.8.7 - Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 6.10.2 - Compensating control
As a temporary mitigation, validate and sanitize all SVG files before loading them with VectorImage, or only load SVG files from trusted sources.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14576?
CVE-2025-14576 is considered a high severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2025-14576?
To address CVE-2025-14576, update to the latest version of Qt that includes the security patch for the VectorImage component.
What components are affected by CVE-2025-14576?
CVE-2025-14576 affects the Qt SVG module and the VectorImage component in Qt Quick.
What types of attacks can exploit CVE-2025-14576?
CVE-2025-14576 can be exploited through malicious SVG files that allow QML/JavaScript code injection.
Is CVE-2025-14576 present in all versions of Qt?
The vulnerability CVE-2025-14576 may be present in various versions of Qt prior to applying the necessary security patches.