Through a little known command line argument, applications that configure custom protocol handlers and are are developed using the Qt5 graphical user interface framework can be exposed to a remote code execution vulnerability.
What many developers don't know is that when you use the Qt5 framework, it also adds command line arguments that can be used to modify how the framework works, such as what window title to show, the size of the window, or even its icon.
These command line arguments are passed to the function that initializes the Qt framework, where they are then parsed as shown below.
... ...