GCVE-110-CERTCC-2022-411271

### Overview Prior to version 5.14, Qt hard-codes the `qt_prfxpath` value to a fixed value, which may lead to privilege escalation vulnerabilities in Windows software that uses Qt. ### Description Prior to version 5.14, Qt hard-codes the `qt_prfxpath` value to a value that reflects the path where Qt exists on the system that was used to build Qt. For example, it may refer to a specific subdirectory within `C:\Qt\`, which is the default installation location for Qt on Windows. If software that is built with Qt runs with privileges on a Windows system, this may allow for privilege escalation due to the fact that Windows by default allows unprivileged users to create subdirectories off of the root `C:\` drive location. In 2015, a [patch](https://codereview.qt-project.org/gitweb?p=qt%2Fqttools.git&a=commit&h=c2952ff8df1e18fe0120d8b29901b0b794afccc7) was made to [windeployqt](https://doc.qt.io/qt-5/windows-deployment.html) to strip out any existing `qt_prfxpath` value from `Qt5Core.dll`. If Windows software that uses Qt prior to version 5.14 is not properly packaged using windeployqt, then it may be vulnerable to privilege escalation. ### Impact By placing a file in an appropriate location on a Windows system, an unprivileged attacker may be able to execute arbitrary code with the privileges of the software that uses Qt. ### Solution #### Apply an update This issue is addressed in Qt 5.14. Starting with this version, Qt no longer hard-codes the `qt_prfxpath` value in `Qt5Core.dll`. #### Run windeployqt to prepare Windows Qt software for deployment The windeployqt utility will replace the `qt_prfxpath` value in the Qt core DLL with the value of `.`, which helps prevent this path from being used to achieve privilege escalation. ### Acknowledgements This document was written by Will Dormann.