The vulnerability CVE-2025-14576 arises from insufficient validation of node IDs in the Qt SVG module. This flaw permits an attacker to inject arbitrary QML/JavaScript code when a malicious SVG file is loaded through the VectorImage component in Qt Quick. Although QML execution is generally more restricted than native code execution, the injected code could still cause denial of service, information disclosure, or other adverse effects depending on the application's privilege level and data access. The affected Qt versions are 6.8.0 and 6.10.0. The CVSS 4.0 base score is 7.4, indicating high severity. No official patch or remediation level has been published by The Qt Company as of the vulnerability's disclosure date.

This vulnerability allows code injection via malicious SVG files, potentially leading to denial of service or information disclosure. The actual impact depends on the privilege level and data access of the affected application using the Qt framework. Since QML execution is more restricted than native code, the risk is somewhat mitigated but still significant. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level has been published by The Qt Company, users should monitor for updates from the vendor. Until a fix is available, avoid loading untrusted or malicious SVG files through the VectorImage component in Qt Quick to reduce risk.