Security readout for executives and security teams
Plain-English summary
A malicious SVG can inject QML/JavaScript into Qt Quick applications that load SVGs through VectorImage. Impact depends on the application’s privileges and data access, but the source notes possible denial of service, information disclosure, and other impacts. Exposure is most urgent where users or external systems can provide SVG files.
Executive priority
Treat as a high-priority patching and exposure review item for desktop or embedded products that process SVG files. It is not currently supported by the supplied sources as actively exploited, but the potential data and availability impact is material.
Technical view
Qt SVG insufficiently validates node IDs before VectorImage handling in Qt Quick, enabling QML/JavaScript injection from malicious SVG content. CVSS is 7.8: local attack vector, low complexity, no privileges, user interaction required, and high confidentiality, integrity, and availability impact. The bundle lists Qt/qtdeclarative 6.8.0 and 6.10.0 as affected.
Likely exposure
Organizations are likely exposed if they ship Qt Quick applications using VectorImage and allow SVGs from users, partners, downloads, email, or other untrusted sources. Server-only systems without Qt Quick SVG rendering are less likely exposed based on the provided evidence.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires a malicious SVG to be loaded through the vulnerable VectorImage path, with user interaction indicated by the CVSS vector.
Researcher notes
Key unknowns are exact fixed version boundaries and application-specific sandboxing. The provided evidence supports QML/JavaScript injection through malicious SVG node IDs in VectorImage, not native code execution. Validation should focus on the vulnerable rendering path and trusted versus untrusted SVG sources.
Mitigation direction
- Apply the Qt qtdeclarative patch or vendor-provided fixed packages.
- Review Red Hat advisories if using affected Red Hat-distributed Qt packages.
- Avoid loading untrusted SVG files through VectorImage until fixed.
- Add file-source controls for user-supplied SVG content in affected applications.
- Monitor Qt and OS vendor guidance for corrected package versions.
Validation and detection
- Inventory applications using Qt Quick VectorImage with SVG input.
- Confirm whether Qt/qtdeclarative 6.8.0 or 6.10.0 is present.
- Verify the Qt patch or relevant Red Hat advisory update is installed.
- Check whether SVG input can originate from untrusted users or external systems.
- Document non-exposure where VectorImage or SVG loading is absent.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-14576 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9redhat-SADPCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U——TQtCVulnerability scoring details
Base CVSS 4.0 score
7.4HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-30T13:01:32.429Z: Reported to Red Hat.
- 2026-04-30T12:39:40.067Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- Qt Code Review - Fix for QTBUG-142556CVE reference, TQtC · patch
- https://access.redhat.com/security/cve/CVE-2025-14576CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2464114CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14576.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24987CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20567CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7620CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7846CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.