Skip to content
Fencer Vulns
medium 6.3

CVE-2026-9499 json

Out-of-bounds read in QTextCodec::codecForName() in Qt

published 2026-07-21 3 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-46257

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

Patch / fix

  • Qt Qt 6.0.0, 6.8.8, 6.11.1
  • qt6-5compat Debian 14 6.10.2-4
  • qtbase-opensource-src Debian 14 5.15.19+dfsg-4

debian advisories DEBIAN-CVE-2026-9499

  • qt5-qtbase RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-gui RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-odbc RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-mysql RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-common RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-examples RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase-postgresql RHEL 9 5.15.9-11.el9_8.1
  • qt5-qtbase RHEL 8 5.15.3-9.el8_10

red hat advisories RHSA-2026:74444RHSA-2026:72378RHSA-2026:72383RHSA-2026:72376RHSA-2026:72377RHSA-2026:70561

  • qt6-qt5compat AlmaLinux 10 6.10.1-1.el10_2.1
  • qt6-qt5compat-examples AlmaLinux 10 6.10.1-1.el10_2.1
  • qt5-qtbase AlmaLinux 8 5.15.3-9.el8_10
  • qt5-qtbase-gui AlmaLinux 8 5.15.3-9.el8_10
  • qt5-qtbase-odbc AlmaLinux 8 5.15.3-9.el8_10
  • qt5-qtbase-mysql AlmaLinux 8 5.15.3-9.el8_10
  • qt5-qtbase-common AlmaLinux 8 5.15.3-9.el8_10
  • qt5-qtbase-examples AlmaLinux 8 5.15.3-9.el8_10

almalinux advisories ALSA-2026:65816ALSA-2026:65897ALSA-2026:65993

  • qt5-qtbase Rocky Linux 8 5.15.3-9.el8_10
  • qt5-qtbase Rocky Linux 9 5.15.9-11.el9_8.1
  • qt6-qt5compat Rocky Linux 10 6.10.1-1.el10_2.1

rocky linux advisories RLSA-2026:65897RLSA-2026:65993RLSA-2026:65816

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9499 updated cvss 7.5

qt: Qt: Denial of Service via out-of-bounds read in text codec handling

  • Red Hat Enterprise Linux 6 qt, qt-x11, qt-odbc, qt-demos, qt-mysql, qt-sqlite, +3 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Hardened Images qt5 5.15.18-3.hum1
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.6) qt5-qtbase-static 5.15.9-11.el9_6.1, qt5-qtbase-debuginfo 5.15.9-11.el9_6.1, qt5-qtbase-debugsource 5.15.9-11.el9_6.1, qt5-qtbase-gui-debuginfo 5.15.9-11.el9_6.1, qt5-qtbase-odbc-debuginfo 5.15.9-11.el9_6.1, qt5-qtbase-devel-debuginfo 5.15.9-11.el9_6.1, +4 more
    fixed: vendor fix RHSA-2026:70562
  • Red Hat Enterprise Linux AppStream (v. 8) qt5-qtbase 5.15.3-9.el8_10, qt5-qtbase-gui 5.15.3-9.el8_10, qt5-qtbase-odbc 5.15.3-9.el8_10, qt5-qtbase-mysql 5.15.3-9.el8_10, qt5-qtbase-common 5.15.3-9.el8_10, qt5-qtbase-examples 5.15.3-9.el8_10, +1 more
    fixed: vendor fix RHSA-2026:65897
  • Red Hat Enterprise Linux AppStream (v. 9) qt5-qtbase 5.15.9-11.el9_8.1, qt5-qtbase-gui 5.15.9-11.el9_8.1, qt5-qtbase-odbc 5.15.9-11.el9_8.1, qt5-qtbase-mysql 5.15.9-11.el9_8.1, qt5-qtbase-common 5.15.9-11.el9_8.1, qt5-qtbase-examples 5.15.9-11.el9_8.1, +1 more
    fixed: vendor fix RHSA-2026:65993
  • Red Hat Enterprise Linux AppStream (v. 10) qt6-qt5compat 6.10.1-1.el10_2.1
    fixed: vendor fix RHSA-2026:65816
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) qt5-qtbase 5.12.5-9.el8_4.1, qt5-qtbase-gui 5.12.5-9.el8_4.1, qt5-qtbase-odbc 5.12.5-9.el8_4.1, qt5-qtbase-mysql 5.12.5-9.el8_4.1, qt5-qtbase-common 5.12.5-9.el8_4.1, qt5-qtbase-examples 5.12.5-9.el8_4.1, +1 more
    fixed: vendor fix RHSA-2026:72376
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) qt5-qtbase 5.15.2-5.el8_6.1, qt5-qtbase-gui 5.15.2-5.el8_6.1, qt5-qtbase-odbc 5.15.2-5.el8_6.1, qt5-qtbase-mysql 5.15.2-5.el8_6.1, qt5-qtbase-common 5.15.2-5.el8_6.1, qt5-qtbase-examples 5.15.2-5.el8_6.1, +1 more
    fixed: vendor fix RHSA-2026:72377
show 15 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) qt5-qtbase 5.15.3-2.el8_8.1, qt5-qtbase-gui 5.15.3-2.el8_8.1, qt5-qtbase-odbc 5.15.3-2.el8_8.1, qt5-qtbase-mysql 5.15.3-2.el8_8.1, qt5-qtbase-common 5.15.3-2.el8_8.1, qt5-qtbase-examples 5.15.3-2.el8_8.1, +1 more
    fixed: vendor fix RHSA-2026:72378
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) qt5-qtbase 5.15.3-2.el9_2.1, qt5-qtbase-gui 5.15.3-2.el9_2.1, qt5-qtbase-odbc 5.15.3-2.el9_2.1, qt5-qtbase-mysql 5.15.3-2.el9_2.1, qt5-qtbase-common 5.15.3-2.el9_2.1, qt5-qtbase-examples 5.15.3-2.el9_2.1, +1 more
    fixed: vendor fix RHSA-2026:70560
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) qt5-qtbase 5.15.9-11.el9_4.1, qt5-qtbase-gui 5.15.9-11.el9_4.1, qt5-qtbase-odbc 5.15.9-11.el9_4.1, qt5-qtbase-mysql 5.15.9-11.el9_4.1, qt5-qtbase-common 5.15.9-11.el9_4.1, qt5-qtbase-examples 5.15.9-11.el9_4.1, +1 more
    fixed: vendor fix RHSA-2026:70561
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) qt6-qt5compat 6.8.1-1.el10_0.1
    fixed: vendor fix RHSA-2026:72383
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) qt5-qtbase 5.15.9-11.el9_6.1, qt5-qtbase-gui 5.15.9-11.el9_6.1, qt5-qtbase-odbc 5.15.9-11.el9_6.1, qt5-qtbase-mysql 5.15.9-11.el9_6.1, qt5-qtbase-common 5.15.9-11.el9_6.1, qt5-qtbase-examples 5.15.9-11.el9_6.1, +1 more
    fixed: vendor fix RHSA-2026:70562
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) qt5-qtbase 5.12.5-9.el8_4.1, qt5-qtbase-gui 5.12.5-9.el8_4.1, qt5-qtbase-odbc 5.12.5-9.el8_4.1, qt5-qtbase-mysql 5.12.5-9.el8_4.1, qt5-qtbase-common 5.12.5-9.el8_4.1, qt5-qtbase-examples 5.12.5-9.el8_4.1, +1 more
    fixed: vendor fix RHSA-2026:72376
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) qt5-qtbase 5.15.2-5.el8_6.1, qt5-qtbase-gui 5.15.2-5.el8_6.1, qt5-qtbase-odbc 5.15.2-5.el8_6.1, qt5-qtbase-mysql 5.15.2-5.el8_6.1, qt5-qtbase-common 5.15.2-5.el8_6.1, qt5-qtbase-examples 5.15.2-5.el8_6.1, +1 more
    fixed: vendor fix RHSA-2026:72377
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) qt5-qtbase 5.15.3-2.el8_8.1, qt5-qtbase-gui 5.15.3-2.el8_8.1, qt5-qtbase-odbc 5.15.3-2.el8_8.1, qt5-qtbase-mysql 5.15.3-2.el8_8.1, qt5-qtbase-common 5.15.3-2.el8_8.1, qt5-qtbase-examples 5.15.3-2.el8_8.1, +1 more
    fixed: vendor fix RHSA-2026:72378
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) qt5-qtbase-static 5.15.9-11.el9_8.1, qt5-qtbase-debuginfo 5.15.9-11.el9_8.1, qt5-qtbase-debugsource 5.15.9-11.el9_8.1, qt5-qtbase-gui-debuginfo 5.15.9-11.el9_8.1, qt5-qtbase-odbc-debuginfo 5.15.9-11.el9_8.1, qt5-qtbase-devel-debuginfo 5.15.9-11.el9_8.1, +4 more
    fixed: vendor fix RHSA-2026:65993
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) qt6-qt5compat-examples 6.10.1-1.el10_2.1
    fixed: vendor fix RHSA-2026:65816
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) qt6-qt5compat-examples 6.8.1-1.el10_0.1
    fixed: vendor fix RHSA-2026:72383
  • Red Hat Enterprise Linux CRB (v. 8) qt5-qtbase-static 5.15.3-9.el8_10, qt5-qtbase-debuginfo 5.15.3-9.el8_10, qt5-qtbase-debugsource 5.15.3-9.el8_10, qt5-qtbase-gui-debuginfo 5.15.3-9.el8_10, qt5-qtbase-odbc-debuginfo 5.15.3-9.el8_10, qt5-qtbase-devel-debuginfo 5.15.3-9.el8_10, +4 more
    fixed: vendor fix RHSA-2026:65897
  • Red Hat Enterprise Linux Server (v. 7 ELS) qt 4.8.7-10.el7_9, qt-x11 4.8.7-10.el7_9, qt-odbc 4.8.7-10.el7_9, qt-mysql 4.8.7-10.el7_9, qt-postgresql 4.8.7-10.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) qt-qvfb 4.8.7-10.el7_9, qt-demos 4.8.7-10.el7_9, qt-config 4.8.7-10.el7_9, qt-examples 4.8.7-10.el7_9, qt-assistant 4.8.7-10.el7_9, qt-qdbusviewer 4.8.7-10.el7_9, +1 more
    fixed: vendor fix RHSA-2026:74444
  • Red Hat Hardened Images qt6 6.11.1-2.hum1, qt6-filesystem 6.11.1-2.hum1, qt6-rpm-macros 6.11.1-2.hum1, qt6-srpm-macros 6.11.1-2.hum1
    fixed: vendor fix RHSA-2026:41389
  • Red Hat Enterprise Linux 6 qt3, qt3-ODBC, qt3-MySQL, qt3-config, qt3-sqlite, qt3-designer, +1 more Red Hat Enterprise Linux 7 qt3, qt3-ODBC, qt3-MySQL, qt3-config, qt3-designer, qt3-PostgreSQL
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Qt Qt

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.