CVE-2026-107590 PUBLISHED

Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt

Assigner: Qt
Reserved: 08.10.2026 Published: 27.10.2026 Updated: 27.10.2026

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green
CVSS Score: 1.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	qt
Product	Qt
Versions	Default: unaffected unaffected from 0 to 4.5.0 (excl.) affected from 4.5.0 to 6.8.8 (incl.) affected from 6.9.0 to 6.11.2 (incl.)

CVE-2026-107590 PUBLISHED

Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt

Metrics

Product Status

References

Problem Types

Impacts