---
id: CVE-2025-14576
title: >-
  Insufficient validation of node IDs in Qt SVG module allows arbitrary
  QML/JavaScript code injection when loading malicious SVG files through the
  VectorImage component in Qt Quick
summary: >-
  Insufficient validation of node IDs in Qt SVG module allows arbitrary
  QML/JavaScript code injection when loading malicious SVG files through the
  VectorImage component in Qt Quick. While QML execution is typically more
  restricted than nat…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
  - CWE-94
  - CWE-94
  - CWE-94
vendor: qt
product: qtdeclarative
affected:
  - 'qtdeclarative >= 6.8.0, < 6.8.6'
  - 'qtdeclarative >= 6.10.0, < 6.10.1'
patched:
  - qtdeclarative 6.10.1
published: '2026-04-30'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14576'
references:
  - url: 'https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273'
    label: a59d8014-47c4-4630-ab43-e1b13cbe58e3
  - url: 'https://access.redhat.com/errata/RHSA-2026:20567'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:24987'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7620'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7846'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2025-14576'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2464114'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00224
epssPercentile: 0.11617
ingestedAt: '2026-07-29T10:45:50.765Z'
---

## Overview

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

## Affected

- `qtdeclarative >= 6.8.0, < 6.8.6`
- `qtdeclarative >= 6.10.0, < 6.10.1`

## Remediation

Upgrade past the affected range:

- `qtdeclarative 6.10.1`