Description
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Affected products
qt: qtdeclarative
References8
- codereview.qt-project.org/c/qt/qtdeclarative/+/697273 Patch
- access.redhat.com/errata/RHSA-2026:20567
- access.redhat.com/errata/RHSA-2026:24987
- access.redhat.com/errata/RHSA-2026:7620
- access.redhat.com/errata/RHSA-2026:7846
- access.redhat.com/security/cve/CVE-2025-14576
- bugzilla.redhat.com/show_bug.cgi?id=2464114
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576…
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 4.0
-
7.4
HIGH
Score source: CNA
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 13 · as of 13 November 2026
- CWE
- CWE-20CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.