CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt
Description
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
INFO
Published Date :
July 21, 2026, 2:16 p.m.
Last Modified :
July 21, 2026, 2:16 p.m.
Remotely Exploit :
Yes !
Source :
a59d8014-47c4-4630-ab43-e1b13cbe58e3
Affected Products
The following products are affected by CVE-2026-9499
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | a59d8014-47c4-4630-ab43-e1b13cbe58e3 | ||||
| CVSS 4.0 | MEDIUM | a59d8014-47c4-4630-ab43-e1b13cbe58e3 |
Solution
- Update to a patched version of Qt.
- Ensure QByteArrays are NUL-terminated before use.
- Avoid passing non-NUL-terminated QByteArrays to the function.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-9499.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-9499 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-9499
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9499 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-9499 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by a59d8014-47c4-4630-ab43-e1b13cbe58e3
Jul. 21, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*'], 'vendor': 'Qt', 'modules': ['Qt5Compat (Core5Compat)'], 'product': 'Qt', 'versions': [{'status': 'affected', 'version': '6.0.0', 'lessThan': '6.8.8', 'versionType': 'python'}, {'status': 'affected', 'version': '6.9.0', 'lessThan': '6.11.1', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*'], 'vendor': 'Qt', 'modules': ['qtbase'], 'product': 'Qt', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '6.0.0', 'versionType': 'python'}], 'defaultStatus': 'unaffected'}] Added Description An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-125 Added Reference https://codereview.qt-project.org/c/qt/qt5compat/+/723911 Added Reference https://codereview.qt-project.org/c/qt/qt5compat/+/724348 Added Reference https://codereview.qt-project.org/c/qt/qt5compat/+/724995 Added Reference https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112