CVE-2025-14576Disclosure(qt / qtdeclarative)

LOWCVSS 7.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

qt CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273

Other references

Weakness type (CWE)

CWE-20CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

qtdeclarative

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

Products

qtdeclarative

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud163d
Disclosure
🚨*CVE* CVE-2025-14576 Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component… https://www.cve.org/CVERecord?id=CVE-2025-14576 ----- Traducción: CVE-2025-14576 Val… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2025‑14576, describing a Qt SVG module flaw enabling QML/JavaScript injection via malicious SVG files, but it provides no PoC, exploit code, or patch details.
00000629
74 followersView on X
CVE@CVEnew163d
Disclosure
CVE-2025-14576 Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component… https://www.cve.org/CVERecord?id=CVE-2025-14576
Post summary
The CVE announcement reveals an insufficient node ID validation flaw in Qt’s SVG module that permits QML/JavaScript injection via malicious SVGs; no PoC, exploit, or patch information is provided.
00000379
57.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	qt	qtdeclarative	-	-	-

Explore more

Back to dashboard qt CVEs qtdeclarative vulnerabilities