Security readout for executives and security teams
Plain-English summary
A local attacker could cause a Unix application using Qt Network’s OpenSSL backend to trust a rogue certificate authority by placing a crafted certificate file in the application’s working directory. Successful abuse could weaken TLS confidentiality and integrity, but it requires high privileges and specific conditions.
Executive priority
Treat as routine, low-priority remediation because exploitation requires privileged local access and narrow conditions. Increase priority for sensitive TLS clients running from shared or attacker-writable directories, especially where rogue CA trust could expose confidential communications.
Technical view
CVE-2025-14575 is a CWE-427 uncontrolled search-path issue in qtbase. The affected TLS backend can load a crafted certificate from the current working directory as a trusted system CA. CVSS 4.0 rates it 1.8 because exploitation is local, high-complexity, precondition-dependent, and requires high privileges.
Likely exposure
Exposure is limited to Unix applications using Qt Network’s OpenSSL TLS backend where the vulnerable certificate-path behavior is present and an attacker can place files in the working directory. The supplied version list does not define complete affected ranges; confirm applicability with Qt guidance and application maintainers.
Exploitation context
The source bundle does not report active exploitation and marks the CVE as absent from KEV. Exploitation requires local access, high privileges, a crafted certificate file, and control over or access to the application’s working directory. No user interaction is required.
Researcher notes
The referenced Qt change rejects empty path strings in QSslCertificate::fromPath for Qt 6.9.2 and later. This aligns with CWE-427 and current-directory certificate discovery. Evidence supplied does not establish all vulnerable branches, downstream backports, exploit availability, or observed attacks.
Mitigation direction
- Update to Qt 6.9.2 or a vendor-supported release containing the referenced fix.
- Confirm vendor backport availability before changing applications on other Qt branches.
- Prevent untrusted users from writing to application working directories.
- Run affected applications from controlled, non-writable working directories where operationally feasible.
Validation and detection
- Inventory Unix applications that include qtbase and use Qt Network’s OpenSSL backend.
- Identify installed Qt versions and any distribution-provided security backports.
- Review application working-directory ownership and write permissions.
- Confirm the deployed build rejects empty certificate-path strings or contains an equivalent vendor fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-427: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-14575 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 1.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N——TQtCVulnerability scoring details
Base CVSS 4.0 score
1.8LowVector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Gerrit: QSslCertificate::fromPath — reject empty path strings (Qt 6.9.2+)CVE reference, TQtC · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Search Path Element
Uncontrolled Search Path Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.