{"id":"CVE-2025-10729","aliases":["ALSA-2025:19772","AZL-68199","AZL-68208","DEBIAN-CVE-2025-10729","EUVD-2025-32489","GHSA-cprv-rgr4-v7vh","OESA-2026-1627","OESA-2026-1628","OESA-2026-1629","OESA-2026-1630","OESA-2026-1631","OESA-2026-1645","OESA-2026-1646","OESA-2026-1647","OESA-2026-1648","OESA-2026-1649","OESA-2026-4102","RHSA-2025:19772","RHSA-2025:21037","RLSA-2025:19772","RLSA-2025:21037","SUSE-SU-2026:23305-1","UBUNTU-CVE-2025-10729","openSUSE-SU-2025:15630-1","openSUSE-SU-2026:21626-1"],"status":"published","title":"Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00219,"percentile":0.12496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-10-03T14:39:20Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"qt6-qtsvg","fixed_in":["6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"qt6-qtsvg-devel","fixed_in":["6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"qt6-qtsvg-examples","fixed_in":["6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qtsvg","fixed_in":["6.6.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"qt5-qtsvg","fixed_in":["5.12.11-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qt6-svg","fixed_in":["6.10.2-5"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qt5-qtsvg","fixed_in":["5.15.10-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"qt5-qtsvg","fixed_in":["5.15.10-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"qt5-qtsvg","fixed_in":["5.15.10-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"qt5-qtsvg","fixed_in":["5.15.10-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"qt5-qtsvg","fixed_in":["5.15.2-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"qt5-qtsvg","fixed_in":["5.11.1-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-debuginfo","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-debugsource","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-devel","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-tests-debuginfo","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-examples","fixed_in":["0:6.8.1-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-debuginfo","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-debugsource","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-devel","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-tests-debuginfo","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-examples","fixed_in":["0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"qt6-qtsvg","fixed_in":["0:6.8.1-1.el10_0.1","0:6.9.1-2.el10_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qt6-svg","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qt6-svg-docs","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qt6-svg","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qt6-svg-docs","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"qt6-svg","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"qt6-svg-docs","fixed_in":["6.9.1-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"qt6-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"qt6-qtsvg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"qt6-qtsvg-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.10.2-4","6.10.2-5","6.10.2-6","6.10.2-7","6.10.2-8","6.10.2-9","6.11.2-1","6.11.2-2","6.4.2-2","6.4.2-3","6.4.2-4","6.6.0-1","6.6.0-2","6.6.1-1","6.6.2-1","6.6.2-2","6.7.2-1","6.7.2-2","6.7.2-3","6.7.2-4","6.7.2-5","6.7.2-6","6.8.2-1","6.8.2-2","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3","6.9.2-4","6.9.2-5"]},{"source":"osv","ecosystem":"Debian:13","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.10.2-4","6.10.2-5","6.10.2-6","6.10.2-7","6.10.2-8","6.10.2-9","6.11.2-1","6.11.2-2","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3","6.9.2-4","6.9.2-5"]},{"source":"osv","ecosystem":"Debian:14","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.2-5"}]}],"versions":["6.10.2-1","6.10.2-2","6.10.2-3","6.10.2-4","6.8.2-3","6.9.1-1","6.9.1-2","6.9.2-1","6.9.2-2","6.9.2-3","6.9.2-4","6.9.2-5"]},{"source":"osv","ecosystem":"Debian:12","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10-1","5.15.10-2","5.15.12-1","5.15.13-1","5.15.13-2","5.15.15-1","5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2","5.15.8-3","5.15.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2"]},{"source":"osv","ecosystem":"Debian:14","package":"qtsvg-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15-2","5.15.17-1","5.15.17-2","5.15.17-3","5.15.18-1","5.15.19-1","5.15.19-2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"qt6-qtsvg-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"qt6-qtsvg-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"qt6-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.1-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"qt6-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.1-2.el10_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qt6-svg-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qt6-svg-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2-2ubuntu1","6.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-4ubuntu1","6.4.2-4ubuntu2","6.4.2-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.3-0ubuntu1","6.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-2","6.10.2-8ubuntu1","6.10.2-9","6.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2-1","6.9.2-4","6.9.2-5","6.10.2-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qt6-svg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qt6-svg-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1-160000.3.1"}]}]}],"products":[{"vendor":"qt","product":"qt"},{"vendor":"the qt company","product":"qt"}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtsvg/+/676473","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10729","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cprv-rgr4-v7vh"},{"url":"https://access.redhat.com/errata/RHSA-2025:19772","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10729","tags":["report"]},{"url":"https://bugzilla.redhat.com/2401241","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-19772.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-10729","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1627","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1628","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1629","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1630","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1631","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1645","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1646","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1647","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1648","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1649","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4102","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2401241","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19772.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10729","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21037","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21037.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:19772","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:21037","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623305-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250994","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10729","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-10729","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10728","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-10729","title":"Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T14:39:20.433Z","modified":"2026-07-29T08:57:33.62Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:30.9782Z"}],"euvd":[{"id":"EUVD-2025-32489","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T14:39:20Z","modified":"2026-07-29T08:57:33Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T18:02:30.59681Z"}],"ghsa":[{"id":"GHSA-cprv-rgr4-v7vh","title":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will...","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T18:31:27Z","modified":"2025-10-03T18:31:27Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:03:51.355149Z"}],"nvd":[{"id":"CVE-2025-10729","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T16:16:16.777Z","modified":"2026-10-08T22:10:00.563Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red","level":"critical","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"DEBIAN-CVE-2025-10729","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T16:16:16.777Z","modified":"2026-10-09T09:47:24.54395585Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2026-1627","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-15T07:32:44Z","modified":"2026-08-18T01:19:40.313428654Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1628","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-15T07:32:45Z","modified":"2026-08-18T01:19:40.332952741Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1629","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-15T07:32:47Z","modified":"2026-08-18T01:19:40.887034861Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1630","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-15T07:32:48Z","modified":"2026-08-18T01:19:40.419957242Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1631","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-15T07:32:49Z","modified":"2026-08-18T01:19:40.420145791Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1645","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.528491398Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1646","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.44187965Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1647","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:41.061829204Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1648","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.42646137Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1649","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.474953197Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-4102","title":"qt5-qtsvg security update","description":"The Qt SVG module provides functionality for displaying SVG images in widget, and to create SVG files using drawing commands.\r\n\r\nSecurity Fix(es):\n\nThe module will parse a \u0026lt;pattern\u0026gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.(CVE-2025-10729)","status":"published","published":"2026-09-25T01:28:25Z","modified":"2026-09-25T01:45:13.114631354Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2025:19772","title":"Red Hat Security Advisory: qt6-qtsvg security update","status":"published","published":"2025-11-06T10:06:08Z","modified":"2026-06-26T12:22:44.808103309Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:21037","title":"Red Hat Security Advisory: qt6-qtsvg security update","status":"published","published":"2025-11-12T10:28:33Z","modified":"2026-06-26T12:22:45.123716392Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2025:19772","title":"Important: qt6-qtsvg security update","description":"Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.\n\nSecurity Fix(es):\n\n* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-11-06T09:08:39.416791Z","modified":"2025-11-06T09:48:55.966703Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:21037","title":"Important: qt6-qtsvg security update","description":"Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.\n\nSecurity Fix(es):\n\n* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-11-21T18:19:15.687303Z","modified":"2025-11-21T18:48:55.989705Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-10729","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T16:16:00Z","modified":"2026-10-17T12:56:47.433346711Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2025:19772","title":"Important: qt6-qtsvg security update","description":"Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.  \n\nSecurity Fix(es):  \n\n  * qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-05T00:00:00Z","modified":"2026-10-29T11:58:15.73787Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-68199","title":"CVE-2025-10729 affecting package qtsvg for versions less than 6.6.1-3","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T16:16:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.994498Z"},{"id":"AZL-68208","title":"CVE-2025-10729 affecting package qt5-qtsvg for versions less than 5.12.11-7","description":"The module will parse a \u003cpattern\u003e node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.","status":"published","published":"2025-10-03T16:16:16Z","modified":"2026-04-21T04:38:21.187595Z","updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"openSUSE-SU-2025:15630-1","title":"libQt6Svg6-6.10.0-1.1 on GA media","description":"These are all security issues fixed in the libQt6Svg6-6.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-13T00:00:00Z","modified":"2026-03-23T04:54:01.740209Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:21626-1","title":"Security update for qt6-svg","description":"This update for qt6-svg fixes the following issue:\n\n- CVE-2025-10729: use-after-free when processing `pattern` group nodes (bsc#1250994).\n","status":"published","published":"2026-08-24T09:40:40Z","modified":"2026-08-27T18:23:12.287987646Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23305-1","title":"Security update for qt6-svg","description":"This update for qt6-svg fixes the following issue:\n\n- CVE-2025-10729: use-after-free when processing `pattern` group nodes (bsc#1250994).\n","status":"published","published":"2026-08-24T09:39:11Z","modified":"2026-09-10T18:23:19.872899572Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}