CVE-2025-14576

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273	Patch
https://access.redhat.com/errata/RHSA-2026:20567
https://access.redhat.com/errata/RHSA-2026:24987
https://access.redhat.com/errata/RHSA-2026:7620
https://access.redhat.com/errata/RHSA-2026:7846
https://access.redhat.com/security/cve/CVE-2025-14576
https://bugzilla.redhat.com/show_bug.cgi?id=2464114
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:qt:qtdeclarative::::::::
	cpe:2.3:a:qt:qtdeclarative::::::::

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Validación insuficiente de IDs de nodo en el módulo SVG de Qt permite la inyección de código QML/JavaScript arbitrario al cargar archivos SVG maliciosos a través del componente VectorImage en Qt Quick. Si bien la ejecución de QML suele ser más restringida que la ejecución de código nativo, esto aún podría conducir a denegación de servicio, revelación de información u otros impactos dependiendo del nivel de privilegio de la aplicación y el acceso a los datos.

Information

Published : 2026-04-30 13:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-14576

Mitre link : CVE-2025-14576

CVE.ORG link : CVE-2025-14576

JSON object : View

Products Affected

qt

qtdeclarative

CWE

CWE-20

Improper Input Validation

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-14576", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14576", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-30T13:13:55.418329Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "affectedData": [{"vendor": "Qt", "modules": ["Qt Declarative (Qt Quick)", "VectorImage Component"], "product": "Qt", "versions": [{"status": "affected", "version": "6.8.0", "versionType": "python", "lessThanOrEqual": "6.8.6"}, {"status": "affected", "version": "6.10.0", "versionType": "python", "lessThanOrEqual": "6.10.1"}], "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android", "x86", "ARM", "64 bit", "32 bit"], "packageName": "qtdeclarative", "collectionURL": "https://www.qt.io/", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:6.10.1-1.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "qt6-qtdeclarative", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:6.8.1-5.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "qt6-qtdeclarative", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "5.15.18-2.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "qt5-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "6.11.0-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "qt6-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_globalhub"], "vendor": "Red Hat", "product": "Multicluster Global Hub", "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:acm:2"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "packageName": "rhacm2/acm-grafana-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "qt6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "qt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "qt3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "qt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "qt3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "qt5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "qt5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ose-cluster-control-plane-machine-set-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_gitops:1"], "vendor": "Red Hat", "product": "Red Hat OpenShift GitOps", "packageName": "openshift-gitops-1/argocd-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-04-30T13:16:02.850", "references": [{"url": "https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273", "tags": ["Patch"], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}, {"url": "https://access.redhat.com/errata/RHSA-2026:20567", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:24987", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:7620", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:7846", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-14576", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464114", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access."}, {"lang": "es", "value": "Validaci\u00f3n insuficiente de IDs de nodo en el m\u00f3dulo SVG de Qt permite la inyecci\u00f3n de c\u00f3digo QML/JavaScript arbitrario al cargar archivos SVG maliciosos a trav\u00e9s del componente VectorImage en Qt Quick. Si bien la ejecuci\u00f3n de QML suele ser m\u00e1s restringida que la ejecuci\u00f3n de c\u00f3digo nativo, esto a\u00fan podr\u00eda conducir a denegaci\u00f3n de servicio, revelaci\u00f3n de informaci\u00f3n u otros impactos dependiendo del nivel de privilegio de la aplicaci\u00f3n y el acceso a los datos."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:qtdeclarative:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06BB3954-EACC-4FD9-B24D-88CBC2043FC3", "versionEndExcluding": "6.8.6", "versionStartIncluding": "6.8.0"}, {"criteria": "cpe:2.3:a:qt:qtdeclarative:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68D670C7-EF6F-468E-AD32-31F9169A8A20", "versionEndExcluding": "6.10.1", "versionStartIncluding": "6.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}