CVE-2026-107472
Received Received - Intake

Out-of-Bounds Read in Qt 5 Compatibility APIs

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: TQtC

Description
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-107472
EUVD
EUVD-2026-110622

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt Qt 4.0.0
qt Qt 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in the QTextCodec TSCII encoding of Qt 5 Compatibility APIs. It affects Qt applications that convert text to TSCII encoding using QTextCodec. The flaw allows reading memory outside the input buffer, potentially causing crashes or data misinterpretation.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Qt 5 or earlier with the TSCII encoding feature. Inspect applications using QTextCodec for TSCII encoding. Check Qt version with commands like 'qmake --version' or 'dpkg -l | grep qt5' on Linux. Review application logs for crashes during text conversion.

Impact Analysis

The vulnerability may cause applications to crash or behave unexpectedly due to reading invalid memory. It could also lead to incorrect data processing, though arbitrary code execution is unlikely. The impact depends on how the affected Qt application is used.

Mitigation Strategies

Upgrade Qt to a patched version if available. Disable or avoid using TSCII encoding in QTextCodec. Apply application-specific patches if provided by the vendor. Monitor for crashes in applications handling text conversion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart