CVE-2025-14576highCWE-20CWE-94

CVE-2025-14576: high-severity vulnerability in Qt

Possible QML code injection in VectorImage component

Published · Updated

Follow this CVE+ Monitor Qt+ Monitor qt6-declarative

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 0.2%
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
Affected products
Qt · Qt
Related CVEs — Qt

In the same product, most dangerous first.

CVE-2026-15037LOWXML injection vulnerability in QDom comment, CDATA and processing-instruction serializationEPSS 0.4%CVE-2025-6338CRITICALPossible denial of service with multiple incoming connections to a Schannel based server with a TLS backendEPSS 0.4%CVE-2025-5455HIGHPossible denial of service when passing malformed data in a URL to qDecodeDataUrlEPSS 0.4%CVE-2025-30348MEDIUMCVE-2025-30348EPSS 0.4%CVE-2025-12385HIGHImproper validation of <img> tag size in Text component parserEPSS 0.3%CVE-2025-5992LOWPassing values outside of expected range to QColorTransferGenericFunction can cause a denial of serviceEPSS 0.3%