PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9499 Qt CVE debrief

An out-of-bounds read vulnerability exists in QTextCodec::codecForName() in Qt. The function is called with a QByteArray that is not NUL-terminated, the codec-name matching routine reads past the end of the supplied buffer. This can lead to an incorrect text codec being selected or, in the worst case, a denial of service if the over-read reaches unmapped memory. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity.

Vendor
Qt
Product
Unknown
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Developers and administrators using Qt 6.0.0 or later, particularly those using the Qt5Compat module or Qt Core (qtbase) in Qt 4.x and Qt 5.x, should be aware of this vulnerability. They should review and update their Qt installations to the latest version and ensure that QByteArrays passed to QTextCodec::codecForName() are NUL-terminated.

Technical summary

The vulnerability occurs when QTextCodec::codecForName() is called with a QByteArray that is not NUL-terminated. This can lead to an incorrect text codec being selected or, in the worst case, a denial of service if the over-read reaches unmapped memory. The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed.

Defensive priority

Medium priority due to the CVSS score of 6.3 and potential for denial of service.

Recommended defensive actions

  • Review and update Qt to the latest version
  • Ensure QByteArrays passed to QTextCodec::codecForName() are NUL-terminated
  • Monitor for and apply patches from Qt
  • Perform a thorough review of the affected Qt modules and versions to identify potential exposure
  • Implement compensating controls to mitigate potential impacts
  • Track and verify changes to the Qt library and dependent applications
  • Conduct regular security audits to detect and address potential vulnerabilities

Evidence notes

The CVE record was published on 2026-07-21T14:16:35.843Z and last modified on 2026-07-22T19:17:14.880Z. The NVD entry is currently in the 'Received' status. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy and completeness of the information.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T14:16:35.843Z and has not been modified since then. The NVD entry is currently Received.