{"id":"CVE-2020-24742","title":"An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.","summary":"An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"qt","product":"qt","affected":["qt >= 5.6.0, < 5.12.7","qt >= 5.13.0, <= 5.13.2"],"patched":["qt 5.12.7"],"published":"2021-08-09","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:26.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-24742","references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/280730","label":"cve@mitre.org"},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/280730","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01167,"epssPercentile":0.66363,"ingestedAt":"2026-10-08T22:11:53.740Z","slug":"CVE-2020-24742","body":"## Overview\n\nAn issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.\n\n## Affected\n\n- `qt >= 5.6.0, < 5.12.7`\n- `qt >= 5.13.0, <= 5.13.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `qt 5.12.7`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}