CVE-2025-14576: qtdeclarative from 6.8.0 (inclusive), before 6.8.6 (exclusive), from 6.10.0 (inclusive), before 6.10.1 (exclusive)…

Affected technology

qtdeclarative · from 6.8.0 (inclusive), before 6.8.6 (exclusive)
qt

qtdeclarative · from 6.10.0 (inclusive), before 6.10.1 (exclusive)
qt

Qt · 6.8.0 through 6.8.6, 6.10.0 through 6.10.1
Qt

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10.0 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Hardened Images · Exact affected versions not specified by the source
Red Hat

Multicluster Global Hub · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 6 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps · Exact affected versions not specified by the source
Red Hat

Component: Qt Declarative (Qt Quick), VectorImage Component

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

The source reports that an attacker could disrupt service and access information they should not be able to access under the conditions described by the source. Source advisory’s CVSS 4.0 assessment (base score 7.4/10) rates confidentiality, integrity and availability impact as high.