Qt Fixes Dual Critical Vulnerabilities (CVE-2025-10728 & CVE-2025-10729) in SVG Module

The Qt Group has released a security advisory about two critical vulnerabilities in the Qt SVG module, tracked as CVE-2025-10728 and CVE-2025-10729, with a CVSS base score of 9.4. The issues affect Qt versions 6.7.0 through 6.8.4 and 6.9.0 through 6.9.2; the first flaw arises when rendering SVG files with recursive pattern elements, potentially causing a stack overflow DoS.

The second flaw occurs during parsing of a pattern node that is not a child of a structural node, where the node can be deleted yet accessed later, leading to a use-after-free bug that could enable remote code execution in untrusted-rendering environments. Both vulnerabilities are described as highly impactful, emphasising the risk to software relying on Qt-based graphical rendering across desktop, automotive, medical, and IoT contexts, and both carry a CVSS 4.0 base score of 9.4.

The advisory recommends upgrading to Qt 6.9.3 or 6.8.5 as soon as possible and cautions against rendering untrusted SVG content until systems are fully patched. According to The Qt Group, developers should review third-party dependencies to confirm whether they include the vulnerable module.