Technical impact
A type confusion flaw in Qt SVG marker handling causes a crafted SVG image to induce an out‑of‑bounds heap read and an unprotected recursive loop that bypasses the marker recursion guard. This results in a crash of the application, falling under a denial‑of‑service attack. The issue relies on a mismatch between expected object types, mapping to CWE‑122 (Buffer Overflow) and CWE‑843 (Type Confusion).
Affected Systems
The Qt Company’s Qt framework, specifically the Qt SVG module, is affected. Versions from 6.7.0 up to but excluding 6.8.8, and from 6.9.0 up to but excluding 6.11.1, are vulnerable.
Risk and Exploitability
The vulnerability has a CVSS score of 8.7, indicating high severity. No EPSS score is available, so the exploitation probability remains uncertain, though the base score indicates a significant risk. The flaw is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Attackers only need to provide a malicious SVG file that the Qt application processes. Based on the description, it is inferred that the attack can be carried out with a local or network‑sourced SVG file. No additional authentication or privilege is required beyond the ability to load SVG content.
