CVE-2023-45872

What it actually does

The flaw stems from an incorrect assumption in Qt's QML image handling that content whose type is not yet determined must be an SVG document; supplying any other format triggers an unhandled parsing path that crashes the application.

Why it matters to the business

Qt-based applications become unavailable to users after loading a single crafted image reference, causing service interruptions and potential loss of productivity in desktop or embedded environments that rely on the library.

How an attack unfolds

An attacker crafts a QML document containing an Image element whose source property points to a non-SVG file. When the QML engine resolves the image and the content is fetched or generated later, the incorrect SVG assumption leads to a fatal error and immediate process termination.

How to fix it

Upgrade Qt to version 6.2.11 or 6.6.1 (or later maintenance releases in the respective branches). Rebuild and redeploy all dependent applications against the patched library. Where immediate upgrade is not feasible, validate that all image sources in QML are explicitly typed or pre-validated before use.

How to confirm the fix worked

Confirm the installed Qt version is at least 6.2.11 or 6.6.1. Exercise QML Image elements with both valid SVG and non-SVG content under controlled conditions and verify that the application no longer terminates unexpectedly.

Typical attack path

1. Attacker prepares a QML file or dynamically generated QML string that references an image source whose content type is unknown at load time.
2. The malicious QML is delivered to the target application via network, file, or user-supplied content.
3. The application parses the QML and creates the Image element.
4. When the image content is resolved and found not to be SVG, Qt's internal parser crashes the process.

How to detect it

Monitor application crash logs and core dumps for Qt processes that terminate while parsing QML image elements. Correlate sudden restarts of Qt-based services with recent receipt of untrusted QML or image content.

What your security team should do

• Prioritize upgrade of Qt in all products that render untrusted QML within the next maintenance window.
• Add automated dependency scanning to detect older Qt versions in build pipelines.
• Review QML code paths that load external or user-controlled images and apply explicit content-type checks where possible.