CVE-2025-14576: qt Improper Input Validation
Vulnerability summary
CVE-2025-14576 is a high (CVSS 7.8) Improper Input Validation vulnerability in qt. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.1% of scored vulnerabilities.
Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 29-07-2026Last modifiedVulnerability information updated.
Description
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:UDiffers
- NVDNIST7.4HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Redhat17 products
- qt5< 0:5.15.18-2.1.hum1
- qt5-filesystem< 0:5.15.18-2.1.hum1
- qt5-rpm-macros< 0:5.15.18-2.1.hum1
- qt5-srpm-macros< 0:5.15.18-2.1.hum1
- qt6< 0:6.11.0-1.hum1
Qt2 products
- qt≥ 6.8.0, ≤ 6.8.6 | ≥ 6.10.0, ≤ 6.10.1
- qtdeclarative≥ 6.8.0, < 6.8.6 | ≥ 6.10.0, < 6.10.1
Debian1 product
- qt6-declarativeAll versions (No fix recorded) | < 6.10.2+dfsg-4
Ubuntu1 product
- qt6-declarativeAll versions (No fix recorded)
4 vendors · 21 products
References
20 linksShow all 20 references
- images.redhat.comARTICLE
