CVE-2025-10729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10729", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "TQtC", "dateReserved": "2025-09-19T14:01:08.672Z", "datePublished": "2025-10-03T14:39:20.433Z", "dateUpdated": "2026-07-29T08:57:33.620Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-29T08:57:33.620Z"}, "title": "Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG", "datePublic": "2025-10-03T14:38:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "description": "CWE-416 Use After Free", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129 Pointer Manipulation"}]}], "affected": [{"vendor": "Qt", "product": "Qt", "modules": ["Qt SVG"], "versions": [{"status": "affected", "version": "6.7.0", "lessThanOrEqual": "6.8.4", "versionType": "python"}, {"status": "affected", "version": "6.9.0", "lessThanOrEqual": "6.9.2", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.0", "versionEndIncluding": "6.8.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndIncluding": "6.9.2"}]}]}], "descriptions": [{"lang": "en", "value": "The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The module will parse a &lt;pattern&gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free."}]}], "references": [{"url": "https://codereview.qt-project.org/c/qt/qtsvg/+/676473"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "PRESENT", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "HIGH", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red"}}], "credits": [{"lang": "en", "value": "OSS-Fuzz", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T14:54:46.096203Z", "id": "CVE-2025-10729", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:54:57.318Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T14:54:46.096203Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:54:49.345Z"}}], "cna": {"title": "Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "OSS-Fuzz"}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129 Pointer Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/RE:H/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Qt", "modules": ["Qt SVG"], "product": "Qt", "versions": [{"status": "affected", "version": "6.7.0", "versionType": "python", "lessThanOrEqual": "6.8.4"}, {"status": "affected", "version": "6.9.0", "versionType": "python", "lessThanOrEqual": "6.9.2"}], "defaultStatus": "unaffected"}], "datePublic": "2025-10-03T14:38:00.000Z", "references": [{"url": "https://codereview.qt-project.org/c/qt/qtsvg/+/676473"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.", "supportingMedia": [{"type": "text/html", "value": "The module will parse a &lt;pattern&gt; node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.8.4", "versionStartIncluding": "6.7.0"}, {"criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.9.2", "versionStartIncluding": "6.9.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-29T08:57:33.620Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10729", "state": "PUBLISHED", "dateUpdated": "2026-07-29T08:57:33.620Z", "dateReserved": "2025-09-19T14:01:08.672Z", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "datePublished": "2025-10-03T14:39:20.433Z", "assignerShortName": "TQtC"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Qt SVG"], "product": "Qt", "vendor": "Qt", "versions": [{"lessThanOrEqual": "6.8.4", "status": "affected", "version": "6.7.0", "versionType": "python"}, {"lessThanOrEqual": "6.9.2", "status": "affected", "version": "6.9.0", "versionType": "python"}]}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free."}, {"lang": "es", "value": "El m\u00f3dulo analizar\u00e1 un nodo <pattern> que no es hijo de un nodo estructural. El nodo ser\u00e1 eliminado despu\u00e9s de su creaci\u00f3n, pero podr\u00eda ser accedido posteriormente, lo que lleva a un uso despu\u00e9s de liberar."}], "id": "CVE-2025-10729", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:H/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "HIGH"}, "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10729", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T14:54:46.096203Z", "version": "2.0.3"}}]}, "published": "2025-10-03T16:16:16.777", "references": [{"source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "url": "https://codereview.qt-project.org/c/qt/qtsvg/+/676473"}], "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "type": "Secondary"}]}

{"bugzilla": {"description": "qtsvg: Use-after-free vulnerability in Qt SVG", "id": "2401241", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401241"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-10729", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "qt6-qtsvg", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "qt5-qtsvg", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "qt5-qtsvg", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "qt5-qtsvg", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-03T14:39:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-10729\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-10729\nhttps://codereview.qt-project.org/c/qt/qtsvg/+/676473"], "statement": "Red Hat products incorporate the Qt SVG library for rendering SVGs to users and as such a user must interact with a malicious SVG file to trigger this vulnerability.", "threat_severity": "Important"}

{"created": "2025-10-06T14:42:57.704156+00:00", "updated": "2025-10-06T14:42:57.704226+00:00", "vendors": ["qt", "qt$PRODUCT$qt"]}