Insufficient Validation in Qt SVG Module Affecting Qt Quick

CVE-2025-14576

What is CVE-2025-14576?

The Qt SVG module presents a security flaw due to insufficient validation of node IDs, which could allow an attacker to inject arbitrary QML or JavaScript code when loading compromised SVG files through the VectorImage component in Qt Quick. Though QML execution is constrained compared to native code, the vulnerability can still lead to potential denial of service or unauthorized data exposure, contingent upon the specific privileges and data access levels of the application.

References