CVE-2025-14575: 
Qt vulnerability analysis and mitigation

CVE-2025-14575 is an Uncontrolled Search Path Element vulnerability (CWE-427) in the OpenSSL TLS backend of Qt Network (qtbase) affecting the Qt Framework on Unix systems. It allows a local attacker to load a rogue CA certificate as a trusted system authority by placing a crafted certificate file in the application's working directory. Affected versions include Qt 5.0.0–5.15.19, 6.0.0–6.5.9, 6.6.0–6.8.3, and 6.9.0–6.9.1. It was published on May 19, 2026, and carries a CVSS v4.0 base score of 1.8 (Low) (GitHub Advisory).

The root cause is an uncontrolled search path (CWE-427) in Qt Network's OpenSSL TLS backend, where the application searches the current working directory for CA certificate files before or alongside system trust stores. An attacker who can write to the application's working directory can place a malicious certificate file that the Qt application will accept as a trusted CA authority. Exploitation requires high privileges (write access to the working directory), high attack complexity, and specific deployment conditions (Attack Requirements: Present), making it a difficult but targeted attack vector. A patch-related code review is publicly available at the Qt project's Gerrit instance (GitHub Advisory).

Successful exploitation enables a local attacker to perform TLS man-in-the-middle attacks against encrypted connections initiated by the vulnerable Qt application, as the rogue CA certificate is trusted by the application's TLS stack. This primarily affects confidentiality (interception of encrypted traffic) and integrity (potential manipulation of TLS-protected data), with no direct availability impact. The scope is limited to the vulnerable application's TLS sessions on the local system, with no subsequent system impact (GitHub Advisory, Qt Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.008% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement for local high-privilege access and specific deployment conditions, significantly limiting the attacker pool (GitHub Advisory).

1. Gain local write access: Obtain write permissions to the working directory of a Qt application that uses the OpenSSL TLS backend on a Unix system (requires high privileges or a compromised local account).
2. Craft a rogue CA certificate: Generate a self-signed CA certificate (e.g., using OpenSSL: openssl req -x509 -newkey rsa:4096 -keyout rogue_ca.key -out rogue_ca.pem -days 365 -nodes) that will be used to sign attacker-controlled server certificates.
3. Place the certificate file: Copy the crafted CA certificate file into the application's working directory using the filename or path that Qt Network's OpenSSL backend searches for (e.g., a file matching the expected CA bundle name or path).
4. Position for MitM: Set up a TLS interception proxy using the rogue CA to intercept and decrypt/re-encrypt traffic between the Qt application and its intended server.
5. Trigger application TLS connection: Wait for or cause the Qt application to initiate a TLS connection; the application will load the rogue CA from the working directory and trust certificates signed by it, enabling traffic interception (GitHub Advisory).

• File System: Unexpected or newly created certificate files (.pem, .crt, .cer) in the working directory of Qt-based applications; file timestamps inconsistent with normal application operation.
• Logs: Application TLS errors or unexpected certificate validation successes logged by Qt Network; OpenSSL-related log entries referencing certificate files from non-standard paths.
• Process: Unusual processes with write access to Qt application working directories; unexpected file creation events in application directories detected by file integrity monitoring tools.

Apply the patch available via the Qt project's code review (Gerrit change 642967) and update to a fixed version of Qt once released by The Qt Company. As a workaround, restrict write permissions on Qt application working directories to prevent unauthorized users from placing files there. Additionally, configure applications to run from directories with strict access controls, and monitor application directories for unexpected certificate file creation (GitHub Advisory, Qt Advisory).

The Qt Company published a security advisory blog post addressing this vulnerability shortly after disclosure. Coverage has been limited to vulnerability aggregator sites and security feeds, consistent with the low severity rating. No notable researcher commentary or significant community discussion has been identified beyond standard CVE tracking (Qt Advisory).