Out-of-Bounds Write Vulnerability in Qt QTextCodec of Qt 5 by The Qt Company
CVE-2026-107590

1.9LOW

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
27 October 2026

What is CVE-2026-107590?

An out-of-bounds write vulnerability exists in the QTextCodec encoding function of the Qt 5 Compatibility APIs module. This issue can lead to writing outside the intended buffer memory, potentially causing application crashes and data integrity issues when UTF-8 or other text encodings are incorrectly handled. Applications utilizing Qt libraries for text processing should assess their reliance on QTextCodec and take appropriate measures to mitigate any possible risks.

Affected Version(s)

Qt 4.5.0 <= 6.8.8

Qt 6.9.0 <= 6.11.2

Qt 0 < 4.5.0

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_pr...
vendor-advisory
https://codereview.qt-project.org/c/qt/qt5compat/+/762752
patch

CVSS V4

Score:
1.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.