7.4Yüksek

CVE-2025-14576Possible QML code injection in VectorImage component

Qt Qt; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Hardened Images Yayım: 2026-04-30 15:39 (6 ay önce)

Açıklama

Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.

Zayıflık türü (CWE): CWE-94 CWE-20

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Qt	Qt	6.8.0 – ≤ 6.8.6, 6.10.0 – ≤ 6.10.1
qt	qtdeclarative	6.8.0 – < 6.8.6
Red Hat	Multicluster Global Hub	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Hardened Images	all versions
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift GitOps	—

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)

cpe:2.3:a:qt:qtdeclarative:*:*:*:*:*:*:*:* ≥ 6.8.0 < 6.8.6
cpe:2.3:a:qt:qtdeclarative:*:*:*:*:*:*:*:* ≥ 6.10.0 < 6.10.1

CVSS puanı

7.4Yüksek

Kaynak: TQtC · CVSS 4.0

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Ön koşul: Yok
Gereken yetki: Yok
Kullanıcı etkileşimi: Pasif
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Tüm puanlar (5)

cna	CVSS 4.0	7.4Yüksek
redhat-SADP	CVSS 3.1	7.8Yüksek
a59d8014-47c4-4630-ab43-e1b13cbe58e3	CVSS 4.0	7.4Yüksek
nvd	CVSS 3.1	7.8Yüksek
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.8Yüksek

EPSS (30 günde istismar olasılığı)

0.22%

tüm CVE'lerin %13'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2025-12-12
Yayımlandı2026-04-30 15:39
IP-DB'ye ulaştı2026-10-25 00:03
Son güncelleme2026-10-07 12:10

Numarayı veren (CNA): TQtC
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Red Hat Enterprise Linux

6.2Orta

CVE-2026-128886 dün

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Orta

CVE-2026-110330 dün

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek

CVE-2026-110331 dün

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Orta

CVE-2026-128987 dün

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Orta

CVE-2026-128885 dün

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8Yüksek

CVE-2026-18379 3 gün önce

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…