Executive brief
A vulnerability in the Qt SVG rendering library can cause applications to crash when processing a specially crafted image file. This library is widely used by desktop and mobile applications to display vector graphics. An attacker could exploit this by providing a malicious SVG file, leading to a denial-of-service condition where the application stops responding or closes unexpectedly.
Technical details
A stack overflow vulnerability exists in the Qt SVG module's handling of SVG files. The issue occurs when the renderer encounters a <pattern> element that references itself or creates a circular dependency, leading to infinite recursion during the rendering process. An attacker can exploit this by providing a malformed SVG file to any application using the affected Qt library. This results in a crash (Denial of Service) due to stack exhaustion. A patch has been developed for the qtsvg component to detect and prevent these recursive loops.
Affected products
- Qt Group Qt SVG 6.x, 5.x
Timeline
- 2025-03-10: advisory: Vulnerability disclosed and patch submitted to Qt Project