CVE-2020-24742
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Vulnerability in Qt version 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
Risk Assessment
An attacker could exploit this to execute arbitrary code in the context of the application using Qt, potentially leading to system compromise.
Recommendation
Update Qt to a version containing the fix, or avoid loading plugins from untrusted locations.
Other vulnerabilities in Qt
See all- CVE-2025-6338Critical
Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.
- CVE-2023-51714Critical
In the HTTP2 implementation in Qt before 5.15.17, 6.2.11, 6.5.4, and 6.6.2, there is an incorrect HPack integer overflow check in hpacktable.cpp.
- CVE-2026-78253Low
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
- CVE-2026-19248High
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
- CVE-2026-9499Medium
An out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt. When called with a non-NUL-terminated QByteArray, the codec-name matching routine reads past the buffer. This usually results in incorrect codec selection; worst case, it causes a crash (DoS). Affects Qt5Compat module from Qt 6.0.0 and Qt Core in Qt 4.x and 5.x.
- CVE-2025-12385High
In Qt Quick, the Text component lacks validation of width and height in the <img> tag, potentially causing excessive resource allocation and application unresponsiveness. Affects Qt from 5.0.0 through 6.10.0.
- CVE-2025-5992Low
A vulnerability in Qt's QColorTransferGenericFunction causes a denial of service when passing values outside the expected range, e.g., when processing a specially crafted ICC profile via QColorSpace::fromICCProfile. Affects Qt from 6.6.0 through 6.8.3 and from 6.9.0 through 6.9.1; fixed in 6.8.4 and 6.9.2.
- CVE-2025-5991Low
A Use-After-Free vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module affects only HTTP/2 handling. It arises from a race condition between uploading POST request body and simultaneous handling of HTTP errors. Affects only Qt 6.9.0; fixed in Qt 6.9.1.
- CVE-2025-5683Medium
A vulnerability in Qt causes a crash when loading a specially crafted ICNS image file via QImage. Affects Qt versions 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. Fixed in 6.5.10, 6.8.5, and 6.9.1.
- CVE-2025-5455High
An issue was found in the private API function qDecodeDataUrl() in QtCore, used in QTextDocument and QNetworkReply. Calling it with malformed data, e.g., a URL with a "charset" parameter lacking a value, triggers an assertion and aborts the program (denial of service).
Original NVD description (English source)
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS