CVE-2025-4211: Qt Framework Privilege Escalation Flaw

CVE-2025-4211 Overview

CVE-2025-4211 is an improper link resolution vulnerability [CWE-59] in the QFileSystemEngine component of the Qt corelib module on Windows. The flaw originates from Qt's use of the Windows GetTempPath API, which attackers can manipulate to redirect temporary file operations. The issue traces back to CVE-2024-38081 in the underlying Windows behavior. Any Qt application relying on QDir::tempPath(), QStandardPaths with TempLocation, QTemporaryDir, or QTemporaryFile is affected. Successful exploitation can lead to unauthorized file access, tampering, and local privilege escalation through symlink attacks.

Critical Impact
A local, authenticated attacker can leverage symbolic links against Qt applications on Windows to read, modify, or replace files outside intended temporary directories, enabling privilege escalation.

Affected Products

Qt Framework versions up to and including 5.15.18
Qt Framework versions 6.0.0 through 6.5.8
Qt Framework versions 6.6.0 through 6.8.1 (Windows platform)

Discovery Timeline

2025-05-16 - CVE-2025-4211 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4211

Vulnerability Analysis

The vulnerability resides in QFileSystemEngine, the internal Qt component responsible for resolving filesystem paths on Windows. Qt determines the process temporary directory by calling the Windows GetTempPath API. That API returns a path derived from the TMP, TEMP, and USERPROFILE environment variables without validating whether the resolved directory contains symbolic links or junctions.

When a Qt application writes to a temporary path through QTemporaryFile or QTemporaryDir, it trusts the directory returned by QDir::tempPath(). An attacker who controls the target of a symlink at any point along that path can redirect file creation, reads, or deletions to arbitrary filesystem locations. If the Qt application runs at higher privilege, this results in privilege escalation.

The underlying weakness mirrors CVE-2024-38081, a Windows-side symlink handling issue in the .NET and Microsoft component ecosystem. Qt inherits the exposure by not performing additional validation of the returned temp path.

Root Cause

The root cause is a link-following weakness [CWE-59] triggered by unvalidated reliance on GetTempPath. Qt does not canonicalize or verify that the returned directory is free of user-controlled symlinks before performing file operations. Any low-privileged user who can influence the temp directory environment or plant a symlink in a shared temp location can subvert file access.

Attack Vector

Exploitation requires local access and some level of user interaction with the vulnerable Qt application. The attacker plants a symbolic link or junction inside the temp path resolved by GetTempPath, then waits for a privileged Qt process to invoke QTemporaryFile, QTemporaryDir, or any API backed by QDir::tempPath(). The privileged file operation follows the link, producing writes or deletions in an attacker-chosen location. See the Qt Project Code Review for the patch implementation.

Detection Methods for CVE-2025-4211

Indicators of Compromise

Creation of symbolic links or NTFS junctions inside per-user or system temp directories preceding execution of a Qt-based application.
Unexpected file writes by Qt applications to locations outside %TEMP% or %USERPROFILE%\AppData\Local\Temp.
Modification of sensitive system files with timestamps aligned to Qt application execution.

Detection Strategies

Inventory Windows endpoints for Qt-linked binaries and verify their Qt runtime version against the fixed releases.
Monitor process activity for Qt executables performing file operations that traverse reparse points or resolve outside their expected working directories.
Correlate CreateSymbolicLink and junction creation events in temp directories with subsequent privileged process file access.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 11 (FileCreate) and 15 (FileCreateStreamHash) with rules scoped to %TEMP% and AppData\Local\Temp.
Audit reparse point creation using the Windows Security event 4663 on temp directory objects.
Track environment variable manipulation, especially changes to TMP, TEMP, and USERPROFILE for non-interactive service accounts.

How to Mitigate CVE-2025-4211

Immediate Actions Required

Upgrade all Qt runtimes and statically linked applications to Qt 5.15.19, 6.5.9, 6.8.2, or 6.9.0.
Identify third-party Windows software that bundles vulnerable Qt libraries and apply vendor updates as they become available.
Restrict local user ability to create symbolic links by removing the SeCreateSymbolicLinkPrivilege from standard users.

Patch Information

The Qt Project resolved the issue by replacing reliance on GetTempPath with a validated resolution path that avoids following attacker-controlled links. The fix is available in Qt 5.15.19, Qt 6.5.9, Qt 6.8.2, and Qt 6.9.0. Review the upstream change in the Qt Project Code Review and rebuild dependent applications against the patched libraries.

Workarounds

Set a dedicated, ACL-restricted temp directory per Qt application via the TMP or TEMP environment variable so unprivileged users cannot plant reparse points inside it.
Run Qt-based services under least-privilege service accounts to reduce the impact of successful symlink redirection.
Deny non-administrative users the ability to create symbolic links through Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.

bash

# Group Policy configuration to restrict symlink creation on Windows
# Local Security Policy > User Rights Assignment > Create symbolic links
# Remove: Authenticated Users
# Retain: Administrators only

# Per-application dedicated temp directory (PowerShell)
$AppTemp = "C:\ProgramData\MyQtApp\Temp"
New-Item -Path $AppTemp -ItemType Directory -Force
icacls $AppTemp /inheritance:r
icacls $AppTemp /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
[Environment]::SetEnvironmentVariable("TMP", $AppTemp, "Machine")
[Environment]::SetEnvironmentVariable("TEMP", $AppTemp, "Machine")