# CVE-2025-14576: The Qt Company Qt SVG code injection in VectorImage component

Source: https://junglewise.ai/threats/cve-2025-14576-the-qt-company-qt-svg-code-injection-in-vectorimage-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-14576 · Severity: high · CVSS 7.8 · Published 2026-04-30

A vulnerability in the Qt software framework could allow an attacker to execute malicious code when a user opens a specially crafted SVG image file. Qt is a widely used library for building graphical user interfaces across desktop, mobile, and embedded systems. If exploited, this flaw could allow an attacker to steal sensitive information, disrupt application services, or gain unauthorized access to data depending on the application's permissions.

Vendors: [The Qt Company](https://junglewise.ai/threats/vendors/the-qt-company).

## Quick answers

**Is CVE-2025-14576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14576 being exploited in the wild.

**How severe is CVE-2025-14576?** High severity, with a CVSS score of 7.8, published 30 April 2026.

**Which products and versions are affected?** The Qt Company Qt SVG Qt 6.x versions prior to patch 697273.

**Is there a fix for CVE-2025-14576?** A patch was published on 2026-05-26: Red Hat released security updates for RHEL 10 (RHSA-2026:20567) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14576 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-14576?** Check whether you run The Qt Company Qt SVG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in the Qt SVG module due to improper input validation of node IDs. When a malicious SVG file is processed via the VectorImage component in Qt Quick, an attacker can inject and execute arbitrary QML or JavaScript code. The attack requires a user to open or load a specially crafted SVG file (User Interaction). While QML execution environments are often sandboxed or restricted compared to native code, successful exploitation can lead to full compromise of the application's data and functionality, including denial of service and information disclosure. Patches have been developed for the qtdeclarative component to address this validation failure.

## Affected products

- The Qt Company Qt SVG module Qt 6.x versions prior to patch 697273
- Red Hat Red Hat Enterprise Linux 10 10.0, 10.2

## Timeline

- 2026-04-30: disclosed: Initial publication date
- 2026-05-26: patched: Red Hat released security updates for RHEL 10 (RHSA-2026:20567)

## References

- [https://www.qt.io/](https://www.qt.io/)
- [https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273](https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273)
- [https://access.redhat.com/errata/RHSA-2026:20567](https://access.redhat.com/errata/RHSA-2026:20567)
- [https://access.redhat.com/errata/RHSA-2026:24987](https://access.redhat.com/errata/RHSA-2026:24987)
- [https://access.redhat.com/errata/RHSA-2026:7620](https://access.redhat.com/errata/RHSA-2026:7620)
- [https://access.redhat.com/errata/RHSA-2026:7846](https://access.redhat.com/errata/RHSA-2026:7846)
- [https://access.redhat.com/security/cve/CVE-2025-14576](https://access.redhat.com/security/cve/CVE-2025-14576)