CVE-2026-9499
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt. When called with a non-NUL-terminated QByteArray, the codec-name matching routine reads past the buffer. This usually results in incorrect codec selection; worst case, it causes a crash (DoS). Affects Qt5Compat module from Qt 6.0.0 and Qt Core in Qt 4.x and 5.x.
Risk Assessment
The risk includes potential application crashes (DoS) and incorrect text encoding, which may affect data integrity.
Recommendation
Upgrade Qt to a patched version and avoid passing non-NUL-terminated QByteArrays to QTextCodec::codecForName().
Other vulnerabilities in Qt
See all- CVE-2025-6338Critical
Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.
- CVE-2025-12385High
In Qt Quick, the Text component lacks validation of width and height in the <img> tag, potentially causing excessive resource allocation and application unresponsiveness. Affects Qt from 5.0.0 through 6.10.0.
- CVE-2025-5992Low
A vulnerability in Qt's QColorTransferGenericFunction causes a denial of service when passing values outside the expected range, e.g., when processing a specially crafted ICC profile via QColorSpace::fromICCProfile. Affects Qt from 6.6.0 through 6.8.3 and from 6.9.0 through 6.9.1; fixed in 6.8.4 and 6.9.2.
- CVE-2025-5991Low
A Use-After-Free vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module affects only HTTP/2 handling. It arises from a race condition between uploading POST request body and simultaneous handling of HTTP errors. Affects only Qt 6.9.0; fixed in Qt 6.9.1.
- CVE-2025-5683Medium
A vulnerability in Qt causes a crash when loading a specially crafted ICNS image file via QImage. Affects Qt versions 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. Fixed in 6.5.10, 6.8.5, and 6.9.1.
- CVE-2025-5455High
An issue was found in the private API function qDecodeDataUrl() in QtCore, used in QTextDocument and QNetworkReply. Calling it with malformed data, e.g., a URL with a "charset" parameter lacking a value, triggers an assertion and aborts the program (denial of service).
- CVE-2025-4211High
A symlink attack vulnerability was found in the Qt corelib module on Windows via QFileSystemEngine. The use of GetTempPath API allows manipulation of temporary file paths, potentially leading to unauthorized access and privilege escalation.
- CVE-2025-3512Medium
A heap-based buffer overflow vulnerability was found in QTextMarkdownImporter in Qt. It occurs when processing a malformed Markdown file. Affects Qt versions 6.8.0 to 6.8.4; versions up to 6.6.0 are unaffected, and the fix is in 6.8.4 and later.
- CVE-2023-37369High
In versions of Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
- CVE-2023-38197High
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 related to infinite loops in recursive entity expansion.
Original NVD description (English source)
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.