EUVD-2026-85183
GHSA-mfr5-m9x8-wvjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted SVG path to Qt app
-
ExploitApp parses path via Context2D.path/PathSvg.path
-
ExecutionOut-of-bounds read in path parser
-
ImpactApplication crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Qt Quick/QML application that parses attacker-controlled SVG path strings through Context2D.path or PathSvg.path; the attacker must supply a crafted path string that the application then processes. Limiting factors are significant: the vendor vector is local (AV:L), requires some privilege (PR:L) and passive user interaction (UI:P) such as opening or loading the malicious content, and carries an attack requirement (AT:P) implying specific conditions must hold. The application must actually feed untrusted SVG data into these APIs - apps that only render trusted, bundled SVG assets are not exposed. Exploit maturity is Unreported (E:U), so no working exploit is known. |
| Impact | This is a genuinely low-priority issue by every available signal, not a high-CVSS-but-overhyped case. The vendor CVSS 4.0 base score is 0.6 with a local attack vector (AV:L), an attack requirement present (AT:P), required privileges (PR:L), and passive user interaction (UI:P). The impact metrics are the most telling: VC:N/VI:N/VA:H, meaning the vendor assesses this as an availability-only crash with NO confidentiality impact - despite the 'Information Disclosure' tag suggesting a memory leak. This is a contradiction worth noting: the tag implies data disclosure, but the vendor's own vector explicitly rates confidentiality impact as None, so the realistic outcome of this OOB read is an application crash, not a leak. The threat-intelligence extensions reinforce low urgency: E:U (exploit Unreported/unproven), R:U, and a 'Green' urgency label. There is no KEV listing, no EPSS score provided, and no public exploit code (the only reference is a Qt code-review patch link, not a proof-of-concept). Net assessment: real but minor, best handled through normal patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious SVG path string and gets it processed by a Qt Quick application that renders untrusted SVG paths via Context2D.path or PathSvg.path (for example, an app that displays user-supplied or downloaded SVG content). When the application parses the malformed path, the out-of-bounds read triggers, most likely crashing the application. No public exploit code exists and the vendor rates exploitation as unproven (E:U). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.
RemediationAI
Patch status: patch available per vendor advisory - Qt has published a fix in the qtdeclarative code review at https://codereview.qt-project.org/c/qt/qtdeclarative/+/754718, which is an upstream commit-level change rather than a tagged release, so the exact patched Qt version is not independently confirmed by the input data and should be verified against Qt's advisory or your distribution's package tracker before relying on a specific version number. Until a patched build is deployed, the most effective compensating control is architectural: stop passing untrusted SVG path strings into Context2D.path and PathSvg.path - validate, canonicalize, or strip SVG 'd' data against a strict allowlist grammar before it reaches these APIs, or convert untrusted SVG to a non-path raster form server-side prior to rendering; the trade-off is added preprocessing cost and potential loss of fidelity for legitimate vector content. Where SVG input cannot be restricted, isolate the rendering process (sandbox, container, or separate low-privilege worker with crash supervision and restart) so that an out-of-bounds read that terminates the process does not take down the host application; this trades memory and orchestration complexity for blast-radius reduction. Network-facing Qt Quick services that consume client-supplied SVG should additionally cap input size and reject malformed path data early, and monitoring for repeated renderer crashes provides a detection signal, though none of these workarounds remove the underlying memory-safety defect - applying the vendor fix remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read in the SVG path-string parsing routines used by Qt Quick. Two QML-facing entry points are named: Context2D.path (the Canvas 2D-style drawing API) and PathSvg.path (the PathSvg QML type used inside Path/Shape elements). Both accept SVG path mini-language data (the moveto/lineto/curveto/arc command syntax used in an SVG 'd' attribute) and tokenize it before converting commands into geometry; a malformed or adversarially constructed path string can drive the parser past the end of an allocated buffer. The CPE entry (cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*) does not constrain a version range, indicating the affected Qt/Qt Declarative code is not tied to a single release line and that consumers should map the flaw to their own Qt version rather than assume immunity. The referenced fix is a Qt Gerrit code-review change in the qtdeclarative repository (change 754718), confirming the defect lives in the Qt Quick/Declarative scene-graph and canvas path handling rather than in the Qt core SVG renderer. Because the flaw is a read (not a write) with VC:N/VI:N in both vectors, the practical impact is process crash/DoS rather than a guaranteed memory-disclosure primitive; the accompanying 'Buffer Overflow' and 'Information Disclosure' tags reflect the general memory-safety class rather than a confirmed exfiltration path.
Know when Qt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green
App must parse attacker-supplied SVG path (local content, user-initiated), yielding a crash only; per vendor no confidentiality impact, so C:N/I:N and A:L.
Primary rating from Vendor (Qt).
CVSS VectorVendor: Qt
DescriptionCVE.org
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (applic
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 charac
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
Exploit-DB