Qt SVG CVE-2025-14576

Exploitation requires applications built with Qt Quick that use the VectorImage component to load and render SVG files. User interaction is mandatory - the victim must actively open or load a malicious SVG file through the vulnerable application. The attack vector is local (AV:L), meaning the attacker must deliver the crafted SVG file to the target system via social engineering, shared storage, removable media, or prior compromise. No authentication is required (PR:N) once the file is accessible to the user. Applications not using Qt Quick, using Qt SVG through non-VectorImage APIs, or not processing SVG files at all are not vulnerable. The scope of impact depends on the victim application's security context: sandboxed applications with restricted QML API access limit potential damage, while privileged applications or those with access to sensitive data enable more severe exploitation. Qt applications on server-side infrastructure that do not process user-supplied SVG files are effectively immune despite running vulnerable Qt versions.

Real-world risk is moderate despite the 7.4 CVSS score. The CVSS vector shows local attack vector (AV:L) with required user interaction (UI:P), significantly limiting exploitability compared to remote network-based attacks. Attack complexity is low (AC:L) once the attacker can deliver a malicious SVG file to the target. The high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) reflect worst-case scenarios where exploited applications have extensive privileges or handle sensitive data. However, no EPSS score is provided to quantify real-world exploitation probability, and the vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation in the wild. The exploit maturity indicator (E:U) confirms no public proof-of-concept exists at time of analysis. The primary risk factors are: (1) Qt is widely deployed in desktop applications, embedded systems, and automotive platforms, creating broad attack surface; (2) SVG is a common file format users routinely open, making social engineering plausible; (3) patch availability from Qt Project reduces window of exposure. The LOCAL attack vector and USER interaction requirement mean this is not remotely exploitable against server infrastructure. Priority should be calibrated based on whether your Qt applications process untrusted SVG files from external sources. For desktop apps opening user-supplied files, this warrants prompt patching; for server-side Qt deployments not handling SVG, risk is minimal.

An attacker crafts a malicious SVG file with specially formatted node IDs containing QML/JavaScript code injection payloads. They deliver this file to a target user via email attachment, shared network drive, or compromised website download, using social engineering to convince the victim to open it. When the user opens the SVG in a vulnerable Qt Quick application (such as a document viewer, image gallery, or custom business app built with Qt), the VectorImage component parses the malicious node IDs and executes the injected QML code. The attacker's code could exfiltrate data accessible to the application, modify the UI to phish credentials, crash the application (denial of service), or pivot to exploit other vulnerabilities in the victim environment. No public proof-of-concept exploit exists, reducing likelihood of widespread automated exploitation, but the low attack complexity means skilled attackers can readily develop custom exploits.