EUVD-2025-209594CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionNVD
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
AnalysisAI
Code injection in Qt SVG module allows attackers to execute arbitrary QML/JavaScript when applications load malicious SVG files through Qt Quick's VectorImage component. Exploitation requires local file access and user interaction (opening crafted SVG). While QML execution is more restricted than native code, attackers can still trigger denial of service, exfiltrate application data, or manipulate UI logic depending on the victim application's privilege context. No active exploitation confirmed (not in CISA KEV), but patch available from Qt Project reduces urgency for immediate emergency response.
Technical ContextAI
This vulnerability affects Qt's declarative UI framework, specifically the integration between the Qt SVG module and Qt Quick's VectorImage component. Qt Quick uses QML (Qt Modeling Language) as a declarative language for building user interfaces, with JavaScript embedded for logic. The flaw stems from insufficient validation of node IDs when parsing SVG files (CWE-94: Improper Control of Generation of Code). Attackers can craft SVG node identifiers that break out of the expected data context and inject executable QML or JavaScript code. When applications using Qt Quick load these SVGs through VectorImage elements, the injected code executes within the QML engine's sandbox. While QML execution has more restrictions than native C++ code execution, it still provides access to application data models, UI state manipulation, and potentially filesystem or network APIs exposed to the QML context. The CPE identifies affected products as Qt framework distributions from The Qt Company, though specific version ranges are not provided in available data.
RemediationAI
Apply the vendor-released patch available through Qt Project code review system at https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273. Monitor Qt's official release channels for the patched Qt version incorporating this fix, as the code review link represents an upstream commit rather than a tagged release. Until patched versions are deployed, implement input validation for SVG files before passing them to VectorImage components: reject SVG files with unusual node ID patterns, enforce strict schema validation, or sanitize SVG content through a trusted parser. For high-security environments, disable VectorImage component usage entirely and use alternative image rendering methods that do not support SVG. Restrict file system permissions so applications cannot access untrusted SVG files from user-writable directories. Apply principle of least privilege to Qt applications so the QML execution context has minimal access to sensitive APIs, filesystems, or network resources. Note that disabling SVG support may break legitimate application functionality requiring vector graphics. Organizations using Qt LTS (Long Term Support) versions should contact The Qt Company support channels for backported patches to older releases.
More from same product – last 7 days
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today