Executive brief
Qt Quick is a graphical framework used in applications to render user interfaces. An out-of-bounds memory read vulnerability exists in the SVG path parsing code when processing untrusted SVG path strings. While the direct impact is limited to information disclosure from memory, this could potentially be leveraged in combination with other vulnerabilities or in specific application contexts.
Technical details
An out-of-bounds read vulnerability exists in Qt Quick's Context2D.path and PathSvg.path components during SVG path string parsing. The vulnerability occurs when untrusted SVG path data is processed without proper bounds validation. An attacker can craft a malicious SVG path string to trigger a read beyond allocated buffer boundaries, potentially reading sensitive data from application memory.
Affected products
- Qt Qt Quick <UNKNOWN>
Timeline
- 2026-09-23: disclosed