CVE-2025-14576 is a code injection vulnerability in the Qt SVG module and VectorImage component in Qt Quick. It enables remote attackers to inject arbitrary QML/JavaScript code by convincing a user to load a specially crafted malicious SVG file. Exploitation can result in denial of service, information disclosure, or other impacts contingent on the application's privileges and data access. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code). Red Hat has issued an advisory (RHSA-2026:7846) addressing this issue in their hardened images and related RPMs.

Successful exploitation allows remote code injection leading to potential denial of service, unauthorized information disclosure, and execution of arbitrary code with the privileges of the affected application. The impact severity is high due to the ability to compromise confidentiality, integrity, and availability of affected systems.

Red Hat has released updated RPM packages addressing this vulnerability as part of their hardened images update. Users should apply these official fixes promptly. No specific mitigations beyond applying the vendor-provided patches are indicated. Patch status is confirmed by Red Hat advisory RHSA-2026:7846. Users should consult the Red Hat advisory for detailed remediation instructions.