CVE-2025-14576

critical

Description

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

References

https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json

https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273

https://bugzilla.redhat.com/show_bug.cgi?id=2464114

https://access.redhat.com/security/cve/CVE-2025-14576

https://access.redhat.com/errata/RHSA-2026:7846

https://access.redhat.com/errata/RHSA-2026:7620

https://access.redhat.com/errata/RHSA-2026:24987

https://access.redhat.com/errata/RHSA-2026:20567

Details

Source: Mitre, NVD

Published: 2026-04-30

Updated: 2026-06-30

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.00012