CVE-2026-9499
Received Received - Intake

Out-of-Bounds Read in Qt Text Codec Handling

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: TQtC

Description
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-9499
EUVD
EUVD-2026-46257

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
qt qt From 6.0.0 (inc)
qt qt 4
qt qt 5
qt qt5compat From 6.0.0 (inc)
qt qtbase 4
qt qtbase 5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in Qt's QTextCodec::codecForName() function. When called with a non-NUL-terminated QByteArray, it reads past the buffer end while matching codec names. This may cause incorrect codec selection or a crash if unmapped memory is accessed. The issue is limited to Qt5Compat in Qt 6.0.0+ and Qt Core in Qt 4.x/5.x.

Detection Guidance

Detecting this vulnerability requires checking if your Qt applications use QTextCodec::codecForName() with non-NUL-terminated QByteArrays. Review application code for calls to QByteArray::fromRawData() passed to QTextCodec::codecForName(). Use static analysis tools to scan Qt-based projects for these patterns. No direct network detection is possible as this is a local code execution issue.

Impact Analysis

If your application passes non-NUL-terminated QByteArrays to QTextCodec::codecForName(), it could crash (denial of service) or behave unexpectedly due to wrong codec selection. Most users are unaffected unless they use raw data arrays without proper termination.

Compliance Impact

This vulnerability does not directly disclose data, so it poses minimal risk to compliance with standards like GDPR or HIPAA. However, if the crash (denial of service) disrupts critical services handling sensitive data, it could indirectly impact compliance by causing service unavailability or data processing delays.

Mitigation Strategies

Immediately update Qt to the latest version where this issue is fixed. If updating is not possible, modify affected code to ensure QByteArrays passed to QTextCodec::codecForName() are NUL-terminated. Avoid using QByteArray::fromRawData() for codec operations. Apply patches from Qt Project if available for your version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart