PatchSiren cyber security CVE debrief
CVE-2026-9499 Qt CVE debrief
An out-of-bounds read vulnerability exists in QTextCodec::codecForName() in Qt. The function is called with a QByteArray that is not NUL-terminated, the codec-name matching routine reads past the end of the supplied buffer. This can lead to an incorrect text codec being selected or, in the worst case, a denial of service if the over-read reaches unmapped memory. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. The vulnerability has a CVSS score of 6.3 and is classified as MEDIUM severity.
- Vendor
- Qt
- Product
- Unknown
- CVSS
- MEDIUM 6.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Developers and administrators using Qt 6.0.0 or later, particularly those using the Qt5Compat module or Qt Core (qtbase) in Qt 4.x and Qt 5.x, should be aware of this vulnerability. They should review and update their Qt installations to the latest version and ensure that QByteArrays passed to QTextCodec::codecForName() are NUL-terminated.
Technical summary
The vulnerability occurs when QTextCodec::codecForName() is called with a QByteArray that is not NUL-terminated. This can lead to an incorrect text codec being selected or, in the worst case, a denial of service if the over-read reaches unmapped memory. The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed.
Defensive priority
Medium priority due to the CVSS score of 6.3 and potential for denial of service.
Recommended defensive actions
- Review and update Qt to the latest version
- Ensure QByteArrays passed to QTextCodec::codecForName() are NUL-terminated
- Monitor for and apply patches from Qt
- Perform a thorough review of the affected Qt modules and versions to identify potential exposure
- Implement compensating controls to mitigate potential impacts
- Track and verify changes to the Qt library and dependent applications
- Conduct regular security audits to detect and address potential vulnerabilities
Evidence notes
The CVE record was published on 2026-07-21T14:16:35.843Z and last modified on 2026-07-22T19:17:14.880Z. The NVD entry is currently in the 'Received' status. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy and completeness of the information.
Official resources
-
CVE-2026-9499 CVE record
CVE.org
-
CVE-2026-9499 NVD detail
NVD
-
Source item URL
nvd_modified
-
Source reference
a59d8014-47c4-4630-ab43-e1b13cbe58e3
-
Source reference
a59d8014-47c4-4630-ab43-e1b13cbe58e3
-
Source reference
a59d8014-47c4-4630-ab43-e1b13cbe58e3
-
Source reference
a59d8014-47c4-4630-ab43-e1b13cbe58e3
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T14:16:35.843Z and has not been modified since then. The NVD entry is currently Received.