A vulnerability exists in the Qt Quick framework’s Context2D.path and PathSvg.path properties, allowing an out‑of‑bounds read while parsing SVG path strings from untrusted sources. This flaw can lead to leakage of the running process’s memory contents, potentially exposing sensitive data to an attacker who can supply crafted SVG data.

The issue affects the Qt framework (qt:qt) on all builds that include Qt Quick’s SVG handling. No specific product or version range is listed in the CNA data, so the vulnerability applies to any Qt installation that utilizes Context2D.path or PathSvg.path without further context in the provided information.

The CVSS score of 0.6 indicates a low impact concern. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The likely attack vector involves sending malicious SVG content to an application that processes such files directly. Because the flaw does not grant code execution or privilege escalation, the immediate risk to confidentiality is relatively mild, but memory disclosure can be leveraged in certain side‑channel or credential‑extraction scenarios.