Description
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Qt | Qt | 6.0.0 – < 6.8.8, 6.9.0 – < 6.11.1, 4.0.0 – < 6.0.0 | 6.8.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-5compat | 6.10.2-4 | — |
| Debian 14 | qtbase-opensource-src | 5.15.19+dfsg-4 | — |
| Debian 13 | qt6-5compat +1 | No fix yet | — |
| Debian 12 | qt6-5compat +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qt6-5compat +1 | No fix yet | — |
| Ubuntu 26.04 LTS | qt6-5compat +1 | No fix yet | — |
| Ubuntu 24.04 LTS | qt6-5compat | No fix yet | — |
| Ubuntu 22.04 LTS | qt6-5compat | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 22.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 20.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 18.04 LTS | qtbase-opensource-src | No fix yet | — |
| Ubuntu Pro 16.04 LTS | qtbase-opensource-src | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | qt6-qt5compat +2 | 6.10.1-1.el10_2.1 | RHSA-2026:65816 |
| RHEL 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.1 | RHSA-2026:65993 |
| RHEL 8 | qt5-qtbase +9 | 5.15.3-9.el8_10 | RHSA-2026:65897 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | qt6-qt5compat +2 | 6.8.1-1.el10_0.1 | RHSA-2026:72383 |
| RHEL 9.6 EUS | qt5-qtbase +9 | 5.15.9-11.el9_6.1 | RHSA-2026:70562 |
| RHEL 9.4 E4S | qt5-qtbase +8 | 5.15.9-11.el9_4.1 | RHSA-2026:70561 |
| RHEL 9.2 E4S | qt5-qtbase +8 | 5.15.3-2.el9_2.1 | RHSA-2026:70560 |
| RHEL 8.8 TUS | qt5-qtbase +8 | 5.15.3-2.el8_8.1 | RHSA-2026:72378 |
| RHEL 8.8 E4S | qt5-qtbase +8 | 5.15.3-2.el8_8.1 | RHSA-2026:72378 |
| RHEL 8.6 EUS Long Life | qt5-qtbase +8 | 5.15.2-5.el8_6.1 | RHSA-2026:72377 |
| RHEL 8.6 AUS | qt5-qtbase +8 | 5.15.2-5.el8_6.1 | RHSA-2026:72377 |
| RHEL 8.4 EUS Long Life | qt5-qtbase +8 | 5.12.5-9.el8_4.1 | RHSA-2026:72376 |
| RHEL 8.4 AUS | qt5-qtbase +8 | 5.12.5-9.el8_4.1 | RHSA-2026:72376 |
| RHEL 7 ELS | qt +13 | 1:4.8.7-10.el7_9 | RHSA-2026:74444 |
| Red Hat Hardened Images 1 | qt6 +3 | 6.11.1-2.hum1 | RHSA-2026:41389 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | qt6-qt5compat +2 | 6.10.1-1.el10_2.1 | ALSA-2026:65816 |
| AlmaLinux 9 | qt5-qtbase +9 | 5.15.9-11.el9_8.1 | ALSA-2026:65993 |
| AlmaLinux 8 | qt5-qtbase +9 | 5.15.3-9.el8_10 | ALSA-2026:65897 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | qt6-qt5compat | 6.10.1-1.el10_2.1 | RLSA-2026:65816 |
| Rocky Linux 9 | qt5-qtbase | 5.15.9-11.el9_8.1 | RLSA-2026:65993 |
| Rocky Linux 8 | qt5-qtbase | 5.15.3-9.el8_10 | RLSA-2026:65897 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +9 | 5.15.3-1.amzn2.0.4 | ALAS2-2026-3980 |
Advisories 20
- ALSA-2026:65993 Important: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65816 Important: qt6-qt5compat security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65897 Important: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2459 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 12, 2026
- ALAS2-2026-3980 Important: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- RHSA-2026:41389 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:74444 Red Hat Security Advisory: qt security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:72383 Red Hat Security Advisory: qt6-qt5compat security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:72378 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:72376 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:72377 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:70562 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:70561 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:70560 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:65993 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:65897 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2026:65816 Red Hat Security Advisory: qt6-qt5compat security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RLSA-2026:65897 Important: qt5-qtbase security update Rocky Linux Security Advisories · Sep 10, 2026
- RLSA-2026:65993 Important: qt5-qtbase security update Rocky Linux Security Advisories · Sep 10, 2026
- RLSA-2026:65816 Important: qt6-qt5compat security update Rocky Linux Security Advisories · Sep 9, 2026