CVE-2025-14576
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Insufficient validation of node IDs in the Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. Although QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Risk Assessment
The organization is at risk of QML/JavaScript code injection attacks via malicious SVG files, which could result in application downtime, sensitive data leakage, or other security breaches, especially if the application runs with elevated privileges.
Recommendation
Immediately update the Qt library to a version containing the fix for this vulnerability and avoid loading SVG files from untrusted sources until the update is applied.
Other vulnerabilities in Qt SVG
See all- CVE-2026-8168High
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt allows a crafted SVG file with deeply nested elements to cause stack exhaustion and application crash (denial of service).
- CVE-2026-6210High
A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image. The issue occurs when processing SVG marker references, where the renderer does not verify the node type before casting.
Original NVD description (English source)
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS