This vulnerability (CVE-2025-14575) in the Qt Framework's OpenSSL TLS backend on Unix platforms involves an uncontrolled search path element (CWE-427). A local attacker with high privileges can exploit this by placing a malicious certificate file in the application's working directory, causing the application to load a rogue CA certificate as a trusted authority. This could undermine TLS security by trusting attacker-controlled certificates. The vulnerability affects Qt versions 5.0.0, 6.0.0, 6.6.0, and 6.9.0. The CVSS 4.0 score is low (1.8) due to the requirement for high privileges and other factors. No vendor advisory or patch information is currently available.

The impact is limited to local attackers with high privileges who can write files to the application's working directory. Successful exploitation allows loading a rogue CA certificate as trusted, potentially enabling man-in-the-middle attacks or interception of TLS communications by the affected application. However, the low CVSS score reflects the high complexity and limited attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write permissions to application working directories and avoid running Qt-based applications with unnecessary elevated privileges to reduce risk.