CVE-2026-9499
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt. When called with a non-NUL-terminated QByteArray, the codec-name matching routine reads past the buffer. This usually results in incorrect codec selection; worst case, it causes a crash (DoS). Affects Qt5Compat module from Qt 6.0.0 and Qt Core in Qt 4.x and 5.x.
Risk Assessment
The risk includes potential application crashes (DoS) and incorrect text encoding, which may affect data integrity.
Recommendation
Upgrade Qt to a patched version and avoid passing non-NUL-terminated QByteArrays to QTextCodec::codecForName().
Other vulnerabilities in Qt
See all- CVE-2026-100140Low
An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.
- CVE-2026-107590Low
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, which can cause the application to crash and may affect data integrity.
- CVE-2025-6338Critical
Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.
- CVE-2023-51714Critical
In the HTTP2 implementation in Qt before 5.15.17, 6.2.11, 6.5.4, and 6.6.2, there is an incorrect HPack integer overflow check in hpacktable.cpp.
- CVE-2026-105924Medium
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. It may lead to application crashes when processing CBOR data.
- CVE-2026-107472Medium
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.
- CVE-2026-107157Low
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
- CVE-2026-101201Medium
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of an out-of-bounds read.
- CVE-2026-78253Low
Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.
- CVE-2026-19248High
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
Original NVD description (English source)
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS