CVE-2026-9499 Details
Description
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
A buffer over-read vulnerability has been identified in the QTextCodec::codecForName() function within the Qt framework. This vulnerability arises when the function processes a QByteArray that is not NUL-terminated, such as those created with QByteArray::fromRawData(). The codec-name matching routine then reads beyond the end of the buffer. Typically, this leads to the selection of an incorrect text codec. In more severe cases, if the over-read extends into unmapped memory, it can cause the process to crash, resulting in a denial-of-service condition. The over-read is limited to the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared against Qt's fixed list of codec names, so no data is leaked to an attacker. Applications that ensure QByteArrays passed to QTextCodec::codecForName() are NUL-terminated are not vulnerable. This issue affects the Qt5Compat module in Qt versions 6.0.0 and later, as well as Qt Core (qtbase) in versions 4.x and 5.x.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codereview.qt-project.org/c/qt/qt5compat/+/723911 | TQtC | Source CodeVendor |
| https://codereview.qt-project.org/c/qt/qt5compat/+/724348 | TQtC | Source CodeVendor |
| https://codereview.qt-project.org/c/qt/qt5compat/+/724995 | TQtC | Source CodeVendor |
| https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112 | TQtC | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | TQtC |
Affected Products
| Product | Versions |
|---|---|
| Qt | >= 6.0.0 (semver) |
CPE
Remediation
| |
| Qt5Compat | >= 6.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | TQtC |