Use After Free Vulnerability in Qt SVG Module by The Qt Company
CVE-2025-10729

9.4CRITICAL

Key Information:

Vendor

The Qt Company

Status
Qt
Vendor
CVE Published:
3 October 2025

What is CVE-2025-10729?

The Qt SVG module contains a vulnerability where a node can be created outside of a structural node. Although this node is deleted instantly after its creation, it may still be accessed later in the program flow, leading to a use after free scenario. This can potentially allow attackers to exploit the situation to execute arbitrary code or cause application crashes.

Affected Version(s)

Qt 6.7.0 <= 6.8.4

Qt 6.9.0 <= 6.9.2

References

https://codereview.qt-project.org/c/qt/qtsvg/+/676473

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OSS-Fuzz
JSON
.
CVE-2025-10729 : Use After Free Vulnerability in Qt SVG Module by The Qt Company