Qt QTextCodec CVE-2026-107590

Exploitation requires a Qt application built against the Qt 5 Compatibility APIs (qt5compat) module that uses the iconv-based QTextCodec encoding path, and the application must be driven to encode attacker-influenced text while a specific triggering condition holds (the sources state the overflow occurs only 'under certain conditions' but do not describe the exact trigger). Limiting factors from the CVSS 4.0 vector: the attack vector is local (AV:L), an attack requirement must be met (AT:P), and passive user interaction is needed (UI:P) - the victim application must perform the encoding operation. Impact is constrained to a crash (availability) and low integrity effect, with no confidentiality impact; applications not using QTextCodec iconv encoding from qt5compat, or outside the listed version ranges, are not affected.

All signals point to a low-priority issue. The input CVSS 4.0 score is 1.9 (Low) with vector AV:L/AC:L/AT:P/PR:N/UI:P and exploit maturity E:U (unproven), and the vuln.today decision label is 'monitor' - the lowest actionable tier. The vulnerability is local (AV:L), not network-reachable, requires a specific attack condition (AT:P) and passive user interaction (UI:P, i.e. the victim application must be driven to encode attacker-influenced text), and its primary impact is availability (VA:H - a crash) with only low integrity impact (VI:L) and no confidentiality impact (VC:N). There is no KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input, consistent with E:U. This is a genuine memory-safety defect (CWE-787 out-of-bounds write) but, on the available evidence, a low real-world-risk denial-of-service / integrity bug rather than a remote code execution priority. Note the data gaps: no CVSS 3.1 vector, EPSS, or SSVC automatable/technical-impact fields were provided, so prioritization rests on the 4.0 vector and the vendor 'monitor' label alone.

An attacker supplies specially crafted text (for example via a document, file, or network payload the application later re-encodes) to a Qt application that uses the QTextCodec iconv-based encoding path from the Qt 5 Compatibility (qt5compat) module. When the application encodes that text under the triggering condition, QTextCodec writes outside its internal buffer, crashing the application and potentially corrupting adjacent data. No public exploit code is identified at time of analysis, and the attack is local with passive user interaction, so this realistically yields denial of service rather than reliable code execution on the evidence available.