PT-2026-36093 · Qt Company · Qt

Published 2026-04-30 · Updated 2026-04-30 · CVE-2025-14576

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qt (affected versions not specified)

Description Insufficient validation of node IDs in the Qt SVG module enables arbitrary QML/JavaScript code injection. This occurs when the VectorImage component in Qt Quick loads malicious SVG files. Such injection can lead to denial of service, information disclosure, or other impacts, depending on the application's privilege level and data access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

CVE-2025-14576

RHSA-2026:7620

RHSA-2026:7846

Affected Products

Qt

References · 10

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14576 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-14576 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14576 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14576 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14576 · Security Note
• https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273 · Patch
• https://github.com/qt/qtdeclarative/commit/1f35339b03fcb8787028e1301012a559328815fb · Note
• https://twitter.com/CVEnew/status/2049872429992804590 · Twitter Post
• https://t.me/CVEtracker/52312 · Telegram Post