Qt SVG Module Node ID Validation Vulnerability Allowing Code Injection via Malicious SVG Files

A vulnerability in the Qt SVG module has been identified, stemming from inadequate validation of node IDs. This flaw enables the injection of arbitrary QML or JavaScript code when malicious SVG files are loaded through the VectorImage component in Qt Quick. Although QML execution is generally more limited than native code execution, this vulnerability could still result in denial of service, information disclosure, or other impacts, depending on the application's privilege level and data access.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in QML or JavaScript, with potential consequences including denial of service, information disclosure, or other impacts based on the application's privileges and data access.