CVE-2026-9499 in Qt
Summary
by MITRE • 07/21/2026
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability represents a classic buffer over-read flaw that exists within Qt's text codec handling mechanism, specifically in the QTextCodec::codecForName() function. The issue manifests when the function processes QByteArray inputs that lack proper null termination, particularly those created using QByteArray::fromRawData() which does not append a null terminator to the data buffer. The root cause lies in how the codec-name matching routine operates without proper bounds checking against the input buffer boundaries, leading to memory access violations beyond the allocated buffer space.
The technical implementation of this vulnerability stems from Qt's internal processing of codec names where the function iterates through candidate codec names from Qt's predefined list to find a match with the provided input. When dealing with non-null-terminated data, the string comparison logic continues reading memory past the intended buffer limits until it encounters a null byte or reaches the maximum length of any codec name in Qt's internal database. This behavior creates an unpredictable execution path that can lead to incorrect codec selection or system instability.
From an operational perspective, this vulnerability poses significant risks to applications relying on Qt's text processing capabilities, particularly those handling untrusted input data through QTextCodec::codecForName() calls. The impact ranges from subtle functional errors where incorrect codecs are selected, potentially corrupting text processing results, to complete application crashes when the over-read accesses unmapped memory regions. The denial of service aspect represents a critical concern for systems where application stability is paramount, as attackers could potentially craft malicious input to trigger crashes and disrupt service availability.
The vulnerability affects multiple Qt versions across different code modules, with the affected implementation residing in Qt5Compat module starting from Qt 6.0.0 releases and also present in Qt Core (qtbase) for older Qt 4.x and 5.x versions. This widespread presence indicates that applications using various Qt frameworks may be exposed to this issue. The bounded nature of the over-read, limited to the maximum codec name length, ensures that no sensitive data is leaked to attackers, but this protective aspect does not mitigate the potential for denial of service attacks.
Security practitioners should consider this vulnerability in relation to CWE-125 Out-of-bounds Read which categorizes buffer over-read conditions as a fundamental memory safety issue. The ATT&CK framework would classify this under T1499.004 Network Denial of Service and potentially T1587.001 Develop Capabilities, as it represents an opportunity for adversaries to craft inputs that trigger application instability through memory access violations.
Mitigation strategies should focus on ensuring proper null termination of input data before passing it to QTextCodec::codecForName() or avoiding the use of non-null-terminated QByteArray instances in text codec operations. Application developers should implement defensive programming practices including buffer length validation and input sanitization, particularly when handling external data sources. Regular Qt version updates should be prioritized to benefit from patches addressing this memory safety issue. Organizations should also consider implementing runtime monitoring for unusual memory access patterns that might indicate exploitation attempts targeting this specific vulnerability in their deployed applications.