Qt Framework EUVD-2026-46257

Exploitation requires two concurrent conditions: (1) the target application must call QTextCodec::codecForName() with a QByteArray constructed via QByteArray::fromRawData() or another method that does not guarantee a NUL terminator on the underlying buffer; and (2) the content or length of that byte array must be influenced by attacker-controlled data, such as a network-supplied charset or encoding name in a file, document, or protocol field. Applications that pass only string literals, the result of QString::toLatin1(), or other NUL-terminated constructions to this function are not exposed. The worst-case crash (DoS) is not deterministic - it requires that the overread advance past the end of a valid memory page into unmapped address space, which depends on runtime memory layout. The CVSS 4.0 AT:P metric explicitly encodes these prerequisite conditions. Authentication requirements are not confirmed from available data: the vector shows PR:N, but whether the network endpoint that feeds codec names is publicly accessible or requires a session depends entirely on the consuming application.

The CVSS 4.0 base score of 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L reflects the constrained nature of this flaw. The AT:P (Attack Requirements Present) metric is the decisive signal: exploitation requires a specific, non-default application code path where a non-NUL-terminated QByteArray is passed to QTextCodec::codecForName(), which is not a typical Qt usage pattern. Integrity impact is Low (incorrect codec selection), and availability impact is Low since a crash occurs only if the overread crosses an unmapped virtual memory page boundary - a hardware- and OS-layout-dependent outcome that is not guaranteed. Confidentiality is explicitly rated N; the authoritative CVE description confirms no data is disclosed. No EPSS score was present in the provided intelligence. The absence of a CISA KEV listing and the lack of any known public exploit further suppress real-world urgency. Notably, the 'Information Disclosure' tag in the source intelligence directly contradicts the CVE description's explicit statement that no data is disclosed to an attacker - this tag is assessed as erroneous, and the vendor-authored description takes precedence. Overall, this is a real but low-priority issue: meaningful only for Qt applications that process untrusted external data through codec-selection APIs using raw, non-NUL-terminated byte arrays.

An attacker sends a malformed codec-name field over the network to a Qt-based application that reads character-encoding metadata from external documents or protocol messages and passes that value - via QByteArray::fromRawData() - directly to QTextCodec::codecForName(). The codec-name matching routine reads past the end of the buffer; if the overread crosses an unmapped virtual memory page, the application process terminates with a segmentation fault, producing a denial-of-service condition. No public exploit code has been identified at time of analysis.