CVE-2025-14575 — Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading

CVE-2025-14575

Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading PUBLISHED

Description (CNA)

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.

Affected (CNA)

Vendor / product	Versions
Qt / Qt	affected 5.0.0 through 5.15.19; affected 6.0.0 through 6.5.9; affected 6.6.0 through 6.8.3; affected 6.9.0 through 6.9.1

CWE

CWE-427

References

https://codereview.qt-project.org/c/qt/qtbase/+/642967

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.