Skip to main content

Qt Framework CVE-2026-9499

| EUVDEUVD-2026-46257 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-21 TQtC GHSA-8cm2-5hwv-mhv9
Denial Of Service Buffer Overflow Information Disclosure Qt Suse Red Hat
6.3
CVSS 4.0 · Vendor: TQtC
Share

Severity by source

Vendor (TQtC) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

AC:H captures the specific non-NUL-terminated QByteArray precondition; C:N is confirmed by the vendor's explicit statement that no data is disclosed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (TQtC).

CVSS VectorVendor: TQtC

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 14:31 vuln.today
CVE Published
Jul 21, 2026 - 13:25 cve.org
MEDIUM 6.3

DescriptionCVE.org

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

AnalysisAI

Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.

Technical ContextAI

Qt is a cross-platform C++ application framework widely used for desktop, embedded, and mobile software. QTextCodec::codecForName() accepts a codec name as a QByteArray and returns the matching text codec object. CWE-125 (Out-of-bounds Read) describes the root cause: when the QByteArray is created with QByteArray::fromRawData() - which wraps a raw C pointer without guaranteeing NUL-termination - the internal codec-name matching loop reads beyond the supplied buffer boundary, comparing overread bytes against Qt's fixed internal list of codec names. The overread distance is bounded by the length of the longest name in that fixed list, and because the overread bytes are never returned to the caller or transmitted externally, there is no data exfiltration path. The flaw exists natively in Qt Core (qtbase) across Qt 4.x and Qt 5.x, and was carried into the Qt5Compat compatibility module used by Qt 6.0.0 and later. CPE string cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* covers all affected versions.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Developers should monitor the four Qt project code review entries at https://codereview.qt-project.org/c/qt/qt5compat/+/723911, https://codereview.qt-project.org/c/qt/qt5compat/+/724348, https://codereview.qt-project.org/c/qt/qt5compat/+/724995, and https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112, and upgrade once a tagged Qt release incorporating these changes is published. As a complete application-level workaround with no side effects, audit all call sites of QTextCodec::codecForName() and ensure the supplied QByteArray is NUL-terminated - avoid using QByteArray::fromRawData() for this purpose, or append a NUL byte explicitly before the call. This eliminates the vulnerability without requiring a Qt runtime upgrade. Applications that do not pass non-NUL-terminated QByteArrays to this function are entirely unaffected and require no action.

More in Qt

View all
CVE-2020-12267 CRITICAL POC
9.8 Apr 27

setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
CVE-2023-37369 HIGH POC
7.5 Aug 20

In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
CVE-2020-13962 HIGH POC
7.5 Jun 09

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
CVE-2020-0570 HIGH POC
7.3 Sep 14

Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
CVE-2024-36048 CRITICAL
9.8 May 18

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
CVE-2017-10904 CRITICAL
9.8 Dec 16

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
CVE-2023-51714 CRITICAL
9.8 Dec 24

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before

CVE-2018-19873 CRITICAL
9.8 Dec 26

An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-19870 HIGH
8.8 Dec 26

An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
CVE-2018-15518 HIGH
8.8 Dec 26

QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
CVE-2026-6210 HIGH
8.7 May 06

Type confusion in Qt SVG renderer allows remote denial of service through malicious SVG images. Attackers can craft SVG

CVE-2015-1860 MEDIUM
6.8 May 12

Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allo

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-9499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy