CVE-2025-14576

Executive Summary

CVE-2025-14576 is a critical vulnerability in the Qt SVG module that allows arbitrary QML/JavaScript code injection when a user loads a malicious SVG file through the VectorImage component in Qt Quick. The root cause is insufficient validation of node IDs within SVG files, enabling an attacker to inject and execute QML code. While QML execution is sandboxed compared to native code, the impact can range from denial of service to information disclosure, depending on the application’s privileges and data access. No official patch has been released by Qt, and no public exploit code is available at this time.

Supply Chain & Package Security

Qt is a widely used cross-platform framework, and this vulnerability affects any application that uses the Qt Quick VectorImage component to render SVG files. The risk is amplified in supply chain scenarios where applications bundle Qt libraries or rely on Qt-based rendering engines. Developers should audit their dependencies and consider alternative SVG parsing libraries until a patch is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete scoring data. Based on the vulnerability characteristics, a reasonable estimated score would be:

• Attack Vector (AV): Network (malicious SVG delivered via web or file)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open the SVG)
• Scope (S): Unchanged
• Confidentiality (C): Low (QML sandbox limits data access)
• Integrity (I): Low (code injection possible but sandboxed)
• Availability (A): Low (potential denial of service)

Estimated CVSS: 5.3 (Medium) – Actual score pending official CVSS vector.

Deep Dive & Mechanics

The vulnerability resides in the Qt SVG module’s handling of node IDs. When parsing an SVG file, the module does not properly sanitize or validate node ID attributes. An attacker can craft an SVG with a malicious node ID that contains QML/JavaScript code. When the VectorImage component in Qt Quick processes this SVG, the injected code is executed within the QML runtime.

The QML runtime provides a sandboxed environment, but it still allows access to certain Qt APIs and application data. Depending on the application’s design, an attacker could:

• Cause denial of service by crashing the QML engine.
• Read sensitive data exposed to QML (e.g., user settings, tokens).
• Manipulate UI elements or trigger unintended actions.

The attack vector is typically social engineering: the victim must open a malicious SVG file (e.g., via email, web download, or file sharing).

Vulnerable vs. Patched Code

No patched code is available from Qt. The vulnerable code is in the SVG parser, likely in files such as qsvghandler.cpp or similar. The issue is that node IDs are passed directly to QML without sanitization.

Vulnerable code (conceptual):

// In SVG parser, node ID is extracted and used directly
QString nodeId = element.attribute("id");
// Node ID is later used in QML context without validation

Patched code (hypothetical):

// Sanitize node ID to remove any QML/JavaScript code
QString nodeId = element.attribute("id");
nodeId.remove(QRegularExpression("[^a-zA-Z0-9_-]"));
// Or use a whitelist approach

Exploitation & Lab Setup

Red Team

No public exploit code is available. To test this vulnerability in a lab environment:

1. Setup: Install a Qt application that uses VectorImage (e.g., a simple QML viewer).
2. Craft SVG: Create an SVG file with a malicious node ID:

   <svg xmlns="http://www.w3.org/2000/svg">
     <rect id="Qt.include('malicious.qml')" width="100" height="100" fill="red"/>
   </svg>
   

   (Note: Actual injection syntax may vary; this is a conceptual example.)
3. Deliver: Send the SVG to the victim via email or web download.
4. Trigger: Victim opens the SVG in the vulnerable application.

Blue Team

• Monitor: Detect attempts to load SVG files with unusual node IDs.
• Sandbox: Run Qt applications in a restricted environment to limit impact.
• User Training: Educate users not to open SVG files from untrusted sources.
• Network Filtering: Block SVG file downloads from suspicious domains.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples yet)
• Network Patterns: SVG files containing QML code in node IDs (e.g., id="Qt.include(...)")
• Process Behavior: Qt application crashing or exhibiting unexpected QML execution.
• Registry/File System: Presence of malicious SVG files with unusual node ID patterns.

Detection Engineering

YARA Rule

rule CVE_2025_14576_SVG_QML_Injection {
    meta:
        description = "Detects SVG files with potential QML injection via node IDs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14576"
    strings:
        $svg_header = "<svg"
        $qml_pattern = /id\s*=\s*"[^"]*Qt\.(include|createComponent|createObject)[^"]*"/ nocase
    condition:
        $svg_header and $qml_pattern
}

Sigma Rule

title: CVE-2025-14576 QML Injection via SVG Node ID
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SVG files with QML injection patterns in node IDs
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '.svg'
        TargetFilename|contains: 'id="Qt.'
    condition: selection
falsepositives:
    - Legitimate SVG files with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14576 QML Injection via SVG Node ID"; flow:to_client,established; file.data; content:"<svg"; within:100; pcre:"/id\s*=\s*\"[^\"]*Qt\.(include|createComponent|createObject)[^\"]*\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

• No official patch available. Monitor Qt’s security advisories for updates.
• Mitigation: Disable SVG rendering in Qt Quick applications if not required.
• Workaround: Use a custom SVG parser that sanitizes node IDs before passing to QML.
• Alternative: Switch to a different image format (e.g., PNG) for untrusted content.
• Network Controls: Block SVG file uploads/downloads in web applications.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: B54463D45DEE6F538282F10C] */}