CVE-2026-107590
Received Received - Intake

Out-of-Bounds Write in Qt QTextCodec

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: TQtC

Description
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-107590
EUVD
EUVD-2026-110826

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qt Qt 4.5.0
qt Qt 6.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds write vulnerability in Qt's QTextCodec iconv-based encoding (part of Qt Core in Qt 5 and earlier). When encoding text under certain conditions, it may write outside an internal buffer, potentially causing crashes or data integrity issues.

Detection Guidance

Detecting this vulnerability requires checking for Qt versions using the affected QTextCodec component. Inspect installed Qt packages with commands like 'dpkg -l | grep qt' on Debian/Ubuntu or 'rpm -qa | grep qt' on RHEL-based systems. Review application logs for crashes during text encoding operations.

Impact Analysis

It can crash applications using Qt and may corrupt data. Since it affects text encoding, any software relying on Qt's QTextCodec for text processing could be vulnerable.

Mitigation Strategies

Update Qt to a patched version. Remove or disable the Qt 5 Compatibility APIs module if unused. Monitor applications using QTextCodec for crashes or memory corruption. Apply vendor patches as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart