CVE-2025-14576
HIGH EPSS 12.6%
Published Apr 30, 20262mo ago · Modified Jun 17, 20262w ago
7.4 CVSS 4.0
Published Apr 30, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X
Threat Intelligence
EPSS Exploit Probability
12.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-20 Improper Input Validation Validation
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
Affected Products 2
References 1
- codereview.qt-project.org https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273
Remediation
- codereview.qt-project.org https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273