CVE-2025-14576
Possible QML code injection in VectorImage component
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Possible QML code injection in VectorImage component
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
CVE-2025-14576- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-20, CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-209594
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
EUVD-2025-209594- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4hpm-v49g-rq7q
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code...
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
GHSA-4hpm-v49g-rq7q- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
NVD
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
CVE-2025-14576- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
OSV
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
CVE-2025-14576- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-14576
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
DEBIAN-CVE-2025-14576- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2026:20567
Red Hat Security Advisory: qt6-qtdeclarative security update
- Record
RHSA-2026:20567- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:24987
Red Hat Security Advisory: qt6-qtdeclarative security update
- Record
RHSA-2026:24987- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7620
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7620- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7846
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7846- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:20567
Important: qt6-qtdeclarative security update
Qt6 - QtDeclarative component.
Security Fix(es):
- qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file (CVE-2025-14576)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:20567- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-14576
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Record
UBUNTU-CVE-2025-14576- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- qt
- qt qtdeclarative
- the qt company qt
- red hat multicluster global hub
- red hat advanced cluster management for kubernetes 2
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 6
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat hardened images
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-declarativeDebian:12 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-5 Show 45 moreShow less6.10.2+dfsg-66.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.4.2+dfsg-16.4.2+dfsg-26.4.2+dfsg-36.4.2+dfsg-46.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-36.6.2+dfsg-16.6.2+dfsg-26.6.2+dfsg-36.6.2+dfsg-46.6.2+dfsg-4+hurd.16.7.2+dfsg-16.7.2+dfsg-106.7.2+dfsg-10+hurd.16.7.2+dfsg-116.7.2+dfsg-26.7.2+dfsg-36.7.2+dfsg-46.7.2+dfsg-56.7.2+dfsg-66.7.2+dfsg-76.7.2+dfsg-86.7.2+dfsg-96.8.2+dfsg-16.8.2+dfsg-26.8.2+dfsg-36.8.2+dfsg-46.8.2+dfsg-56.8.2+dfsg-66.8.2+dfsg-6+alpha6.8.2+dfsg-6+hurd.16.8.2+dfsg-76.8.2+dfsg-7+m68k6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-2 |
None known |
qt6-declarativeDebian:13 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-5 Show 14 moreShow less6.10.2+dfsg-66.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.8.2+dfsg-76.8.2+dfsg-7+m68k6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-46.9.2+dfsg-56.9.2+dfsg-6 |
None known |
qt6-declarativeDebian:14 |
before 6.10.2+dfsg-4, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-26.10.2+dfsg-36.8.2+dfsg-76.8.2+dfsg-7+m68k Show 8 moreShow less6.9.1+dfsg-16.9.1+dfsg-26.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-46.9.2+dfsg-56.9.2+dfsg-6 |
6.10.2+dfsg-4 |
qt6-qtdeclarativeRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-develRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-devel-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-examples-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-tests-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt6-qtdeclarative-examplesRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarative-staticRed Hat:enterprise_linux:10.2 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-qtdeclarativeRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-debugsourceRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-develRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-devel-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-examples-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-tests-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-examplesRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt6-qtdeclarative-staticRed Hat:enterprise_linux_eus:10.0 |
before 0:6.8.1-5.el10_0 | 0:6.8.1-5.el10_0 |
qt5Red Hat:hummingbird:1 |
before 0:5.15.18-2.1.hum1 | 0:5.15.18-2.1.hum1 |
qt5-filesystemRed Hat:hummingbird:1 |
before 0:5.15.18-2.1.hum1 | 0:5.15.18-2.1.hum1 |
qt5-rpm-macrosRed Hat:hummingbird:1 |
before 0:5.15.18-2.1.hum1 | 0:5.15.18-2.1.hum1 |
qt5-srpm-macrosRed Hat:hummingbird:1 |
before 0:5.15.18-2.1.hum1 | 0:5.15.18-2.1.hum1 |
qt6Red Hat:hummingbird:1 |
before 0:6.11.0-1.hum1 | 0:6.11.0-1.hum1 |
qt6-filesystemRed Hat:hummingbird:1 |
before 0:6.11.0-1.hum1 | 0:6.11.0-1.hum1 |
qt6-rpm-macrosRed Hat:hummingbird:1 |
before 0:6.11.0-1.hum1 | 0:6.11.0-1.hum1 |
qt6-srpm-macrosRed Hat:hummingbird:1 |
before 0:6.11.0-1.hum1 | 0:6.11.0-1.hum1 |
qt6-qtdeclarativeRocky Linux:10 |
before 0:6.10.1-1.el10_2.1 | 0:6.10.1-1.el10_2.1 |
qt6-declarativeUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-4ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-3ubuntu1 |
None known |
qt6-declarativeUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-36.4.2+dfsg-46.4.2+dfsg-4build16.4.2+dfsg-4build26.4.2+dfsg-4build3 |
None known |
qt6-declarativeUbuntu:25.10 |
All versions, plus listed versions 6.8.3+dfsg-0ubuntu16.9.2+dfsg-1 |
None known |
qt6-declarativeUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-36.10.2+dfsg-66.11.2+dfsg-2ubuntu1 |
None known |
qt6-declarativeUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-16.9.2+dfsg-56.10.2+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-14576 is a high vulnerability (CVSS 7.4) in Qt, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in qt6-declarative 6.10.2+dfsg-4.
References
codereview.qt-project.org/c/qt/qtdeclarative/+/697273
access.redhat.com/security/cve/CVE-2025-14576
bugzilla.redhat.com/show_bug.cgi?id=2464114
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-14576
github.com/advisories/GHSA-4hpm-v49g-rq7q
security-tracker.debian.org/tracker/CVE-2025-14576
cve.org/CVERecord?id=CVE-2025-14576
images.redhat.com
errata.rockylinux.org/RLSA-2026:20567
ubuntu.com/security/CVE-2025-14576
Left out here: 4 versions. The JSON record has them.