Qt VectorImage EUVD-2026-107159

Exploitation requires a Qt-based application that uses the VectorImage QML type to parse and render an attacker-supplied SVG file; the victim must actively load or open the malicious SVG (UI:A), and the vector is local (AV:L) rather than remote, so the SVG must be delivered to and processed on the target system. Limiting factors: impact is confined to a crash (availability only, no code execution or data exposure), the application must specifically expose SVG rendering via VectorImage QML, and the crafted SVG must reach a user who opens it; exploitation is marked Unproven (E:U) with no public exploit available.

This is a genuinely low-to-moderate priority issue despite the CWE-476 crash potential. All signals align toward limited real-world risk: the CVSS 4.0 vector scores only 4.0 (medium) with a LOCAL attack vector (AV:L), required active user interaction (UI:A), and impact restricted to availability only (VA:H, with VC:N/VI:N) - i.e. a denial-of-service crash, not code execution or data compromise. The CVSS 4.0 threat metric E:U explicitly marks exploitation as Unproven, and there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or likely exploitation. No separate POC is referenced; only the vendor patch and advisory are cited. The one caveat worth verifying: the vector is unauthenticated (PR:N) but local (AV:L) and interaction-dependent (UI:A), meaning the realistic trigger is a victim opening/rendering an attacker-supplied SVG rather than remote network exploitation - consistent with the integer-overflow-to-null-deref described. No conflicting signals were found; the data is internally coherent and points to a low-severity DoS.

An attacker crafts a malicious SVG file with values that cause an integer overflow when processed by Qt's VectorImage QML type. A user opens or loads this SVG within a vulnerable Qt-based application, triggering a null-pointer dereference that crashes the application (denial of service). No public exploit code is identified, and the vector requires local file delivery plus user interaction, limiting practical impact.