This vulnerability (CVE-2025-14575) involves an uncontrolled search path element in the OpenSSL TLS backend of Qt Network (qtbase) on Unix platforms. A local attacker with high privileges can exploit this by placing a malicious certificate file in the application's working directory. The Qt application then mistakenly trusts this rogue CA certificate as a system authority, potentially undermining TLS security. The CVSS 4.0 base score is 1.8, reflecting low severity due to the required privileges and limited impact scope. Affected versions include Qt 5.0.0, 6.0.0, 6.6.0, and 6.9.0. No patch or official remediation level is currently documented.

The impact is limited to local attackers with high privileges who can write files to the application's working directory. Successful exploitation causes the application to trust a rogue CA certificate, potentially enabling man-in-the-middle attacks or interception of TLS communications within the affected application context. However, the low CVSS score and required conditions reduce the overall risk. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write permissions to application working directories to prevent untrusted certificate files from being placed there. Monitor vendor communications for updates on patches or official mitigations.