CVE-2025-14576

HighCVSS 7.8

Published: 30/04/2026(UTC)Updated: 29/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

Insufficient validation of node IDs in the Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. Although QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

Risk Assessment

The organization is at risk of QML/JavaScript code injection attacks via malicious SVG files, which could result in application downtime, sensitive data leakage, or other security breaches, especially if the application runs with elevated privileges.

Recommendation

Immediately update the Qt library to a version containing the fix for this vulnerability and avoid loading SVG files from untrusted sources until the update is applied.

Other vulnerabilities in Qt SVG

CVE-2026-6210High
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. The issue occurs when processing SVG marker references, where the renderer does not verify the node type before casting.

Original NVD description (English source)

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.