Skip to content

CVE-2025-14575

Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading

1.8 LowFix available

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.09%Up 0.1 points since May 20, 2026

What each source reports

CVE List Score used 1.8

Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Record: CVE-2025-14575
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-427
Updated: 2026-11-02

EUVDEUVD-2025-209891 1.8

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Record: EUVD-2025-209891
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f8w9-p7h4-f9jm 1.8

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network ...

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Record: GHSA-f8w9-p7h4-f9jm
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-427
Updated: 2026-11-02

NVD 1.8

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Record: CVE-2025-14575
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-427
Updated: 2026-11-02

OSVOESA-2026-2468 1.8

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2468
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVOESA-2026-2469 1.8

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2469
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

Show 7 moreShow less

OSVOESA-2026-2470 1.8

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2470
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVOESA-2026-2471 1.8

qt5-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2471
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVOESA-2026-2506 1.8

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2506
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVOESA-2026-2507 1.8

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2507
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVOESA-2026-2508 1.8

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.(CVE-2025-14575)

Record: OESA-2026-2508
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-14575 1.8

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Record: UBUNTU-CVE-2025-14575
CVSS 4.0: 1.8 LowCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVSUSE-SU-2026:3116-1 No score

Security update for libqt4

This update for libqt4 fixes the following issue

CVE-2025-14575: local user can load rogue CA certificates as trusted system authority via a crafted file placed in the application's working directory (bsc#1265896).

Record: SUSE-SU-2026:3116-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qt5-qtbase` openEuler:24.03-LTS-SP1	before 5.15.10-15.oe2403sp1	5.15.10-15.oe2403sp1
`qt5-qtbase` openEuler:24.03-LTS-SP3	before 5.15.10-15.oe2403sp3	5.15.10-15.oe2403sp3
`qt5-qtbase` openEuler:22.03-LTS-SP4	before 5.15.2-19.oe2203sp4	5.15.2-19.oe2203sp4
`qt5-qtbase` openEuler:24.03-LTS	before 5.15.10-15.oe2403	5.15.10-15.oe2403
`qt6-qtbase` openEuler:24.03-LTS	before 6.5.2-15.oe2403	6.5.2-15.oe2403
`qt6-qtbase` openEuler:24.03-LTS-SP1	before 6.5.2-15.oe2403sp1	6.5.2-15.oe2403sp1
`qt6-qtbase` openEuler:24.03-LTS-SP3	before 6.5.2-15.oe2403sp3	6.5.2-15.oe2403sp3
`libqt4` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 4.8.7-8.25.1	4.8.7-8.25.1
`libqt4-devel-doc` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 4.8.7-8.25.1	4.8.7-8.25.1
`libqt4-sql-plugins` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 4.8.7-8.25.1	4.8.7-8.25.1

Show 20 moreShow less

Affected packages
Package	Affected	Fixed
`qtbase-opensource-src` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 15 moreShow less 5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2	None known
`qtbase-opensource-src-gles` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less 5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6	None known
`qtbase-opensource-src` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 12 moreShow less 5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2	None known
`qtbase-opensource-src` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 6 moreShow less 5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4	None known
`qtbase-opensource-src-gles` Ubuntu:20.04:LTS	All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1	None known
`qt6-base` Ubuntu:22.04:LTS	All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1	None known
`qtbase-opensource-src-gles` Ubuntu:22.04:LTS	All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1	None known
`qtbase-opensource-src` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3 Show 8 moreShow less 5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3	None known
`qt6-base` Ubuntu:24.04:LTS	All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5	None known
`qtbase-opensource-src-gles` Ubuntu:24.04:LTS	All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1	None known
`qtbase-opensource-src` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1 Show 4 moreShow less 5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1	None known
`qt6-base` Ubuntu:25.10	All versions, plus listed versions 6.8.3+dfsg-0ubuntu26.8.3+dfsg-0ubuntu36.9.2+dfsg-1ubuntu1	None known
`qtbase-opensource-src` Ubuntu:25.10	All versions, plus listed versions 5.15.15+dfsg-4ubuntu15.15.15+dfsg-5ubuntu15.15.17+dfsg-1ubuntu1	None known
`qtbase-opensource-src-gles` Ubuntu:25.10	All versions, plus listed versions 5.15.15+dfsg-25.15.17+dfsg-1	None known
`qt6-base` Ubuntu:26.10	All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2	None known
`qtbase-opensource-src` Ubuntu:26.10	All versions, plus listed versions 5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2	None known
`qtbase-opensource-src-gles` Ubuntu:26.10	All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2	None known
`qt6-base` Ubuntu:26.04:LTS	All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7	None known
`qtbase-opensource-src` Ubuntu:26.04:LTS	All versions, plus listed versions 5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1	None known
`qtbase-opensource-src-gles` Ubuntu:26.04:LTS	All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-14575 is a low vulnerability (CVSS 1.8) in Qt, published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. Fixed in qt5-qtbase 5.15.10-15.oe2403sp1.

References

Show 9 moreShow less