Read the docs
TI-2026-08345 Aliases CVE-2026-9499GHSA-8cm2-5hwv-mhv9

Out-of-bounds read in QTextCodec::codecForName() in Qt

Priority LOW 28CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 21 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Partial Qt (Qt): 6.8.8, 6.11.1, 6.0.0Red Hat: 12 advisoriesRed Hat: 21 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtQt6.0.0 to before 6.8.8; 6.9.0 to before 6.11.16.8.8, 6.11.1Patch availableCNA
qtQt4.0.0 to before 6.0.06.0.0Patch availableCNA
  • Qt Vendorqt Affected 6.0.0 to before 6.8.8; 6.9.0 to before 6.11.1 Fixed in 6.8.8, 6.11.1 Patch available CNA
  • Qt Vendorqt Affected 4.0.0 to before 6.0.0 Fixed in 6.0.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*——qt
  • cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions — — ·qt

Remediation

  • Fix · CNA Qt (Qt) Fixed in 6.8.8, 6.11.1
  • Fix · CNA Qt (Qt) Fixed in 6.0.0

Red Hat 12 advisories

  • RHSA-2026:74444 Released 2026-10-01 · Red Hat rating Important
    qt security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) qt-1:4.8.7-10.el7_9, qt-1:4.8.7-10.el7_9.ppc, qt-devel-1:4.8.7-10.el7_9 +9
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) qt-assistant-1:4.8.7-10.el7_9, qt-config-1:4.8.7-10.el7_9, qt-demos-1:4.8.7-10.el7_9 +5
  • RHSA-2026:72383 Released 2026-09-28 · Red Hat rating Important
    qt6-qt5compat security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) qt6-qt5compat-6.8.1-1.el10_0.1, qt6-qt5compat-devel-6.8.1-1.el10_0.1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) qt6-qt5compat-examples-6.8.1-1.el10_0.1
  • RHSA-2026:72378 Released 2026-09-28 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) qt5-qtbase-5.15.3-2.el8_8.1, qt5-qtbase-common-5.15.3-2.el8_8.1, qt5-qtbase-devel-5.15.3-2.el8_8.1 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) qt5-qtbase-5.15.3-2.el8_8.1, qt5-qtbase-common-5.15.3-2.el8_8.1, qt5-qtbase-devel-5.15.3-2.el8_8.1 +6
Show 9 more Red Hat advisories
  • RHSA-2026:72377 Released 2026-09-28 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) qt5-qtbase-5.15.2-5.el8_6.1, qt5-qtbase-common-5.15.2-5.el8_6.1, qt5-qtbase-devel-5.15.2-5.el8_6.1 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) qt5-qtbase-5.15.2-5.el8_6.1, qt5-qtbase-common-5.15.2-5.el8_6.1, qt5-qtbase-devel-5.15.2-5.el8_6.1 +6
  • RHSA-2026:72376 Released 2026-09-28 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) qt5-qtbase-5.12.5-9.el8_4.1, qt5-qtbase-common-5.12.5-9.el8_4.1, qt5-qtbase-devel-5.12.5-9.el8_4.1 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) qt5-qtbase-5.12.5-9.el8_4.1, qt5-qtbase-common-5.12.5-9.el8_4.1, qt5-qtbase-devel-5.12.5-9.el8_4.1 +6
  • RHSA-2026:70560 Released 2026-09-23 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) qt5-qtbase-5.15.3-2.el9_2.1, qt5-qtbase-common-5.15.3-2.el9_2.1, qt5-qtbase-devel-5.15.3-2.el9_2.1 +6
  • RHSA-2026:70562 Released 2026-09-23 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) qt5-qtbase-static-5.15.9-11.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) qt5-qtbase-5.15.9-11.el9_6.1, qt5-qtbase-common-5.15.9-11.el9_6.1, qt5-qtbase-devel-5.15.9-11.el9_6.1 +6
  • RHSA-2026:70561 Released 2026-09-23 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) qt5-qtbase-5.15.9-11.el9_4.1, qt5-qtbase-common-5.15.9-11.el9_4.1, qt5-qtbase-devel-5.15.9-11.el9_4.1 +6
  • RHSA-2026:65993 Released 2026-09-09 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream (v. 9) qt5-qtbase-5.15.9-11.el9_8.1, qt5-qtbase-common-5.15.9-11.el9_8.1, qt5-qtbase-devel-5.15.9-11.el9_8.1 +6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) qt5-qtbase-static-5.15.9-11.el9_8.1
  • RHSA-2026:65897 Released 2026-09-09 · Red Hat rating Important
    qt5-qtbase security update
    • Red Hat Enterprise Linux AppStream (v. 8) qt5-qtbase-5.15.3-9.el8_10, qt5-qtbase-common-5.15.3-9.el8_10, qt5-qtbase-devel-5.15.3-9.el8_10 +6
    • Red Hat Enterprise Linux CRB (v. 8) qt5-qtbase-static-5.15.3-9.el8_10
  • RHSA-2026:65816 Released 2026-09-09 · Red Hat rating Important
    qt6-qt5compat security update
    • Red Hat Enterprise Linux AppStream (v. 10) qt6-qt5compat-6.10.1-1.el10_2.1, qt6-qt5compat-devel-6.10.1-1.el10_2.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) qt6-qt5compat-examples-6.10.1-1.el10_2.1
  • RHSA-2026:41389 Released 2026-07-18 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images qt6-6.11.1-2.hum1@src, qt6-filesystem-6.11.1-2.hum1@aarch64, qt6-filesystem-6.11.1-2.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:70562
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:65816
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:65897
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:65993
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:72376
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:72377
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:72378
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:70560
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:70561
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:72383
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:70562
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:72376
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:72377
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:72378
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:65897
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:65816
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:65993
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:72383
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:74444
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:74444
Red Hat Hardened ImagesFixed RHSA-2026:41389
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9499
  2. 2026-10-03 Alias added: GHSA-8cm2-5hwv-mhv9

References

Patch 4

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences