Qt Patches Out-of-Bounds Write Vulnerability in QTextCodec
Qt has released security updates for versions 4.5.0 through 6.11.2 to address a buffer overflow vulnerability in its iconv-based encoding path.
Qt disclosed CVE-2026-107590, an out-of-bounds write inside the iconv-based encoding path of QTextCodec.
The vulnerability impacts Qt 4.5.0 through 6.8.8 and Qt 6.9.0 through 6.11.2. The bug lives in the Qt 5 Compatibility APIs module, and in Qt 5 or earlier it resides in QTextCodec within Qt Core. Encoding text using QTextCodec can write outside an internal buffer under certain conditions.
CVSS 4.0 rates this low at 1.9, using the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green. The vector specifies local attack access, a user-interaction requirement, low integrity impact, high availability impact, and no confidentiality impact. According to the advisory, this crashes an application and may impact data integrity.
Fixes are available in Qt 6.8.9, Qt 6.11.3, and Qt 6.12.0. If you cannot upgrade immediately, you can patch qt5compat. Qt provides patches as downloadable diff files and code review changes for the dev, Qt 6.11, and Qt 6.8 branches, with no other mitigations listed.
Published on October 27, 2026, the notice joins two others: CVE-2026-107472 for an out-of-bounds read in TSCII encoding, and CVE-2026-105946 for an out-of-bounds read in NTLM authentication. Qt 6.12 LTS is available now.