CVE-2026-9499

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

• CWE-125

• https://codereview.qt-project.org/c/qt/qt5compat/+/723911
• https://codereview.qt-project.org/c/qt/qt5compat/+/724348
• https://codereview.qt-project.org/c/qt/qt5compat/+/724995
• https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112

Published

Jul 21, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9493Service Center developed by BankPro E-Service Technology has…7.1
• CVE-2026-9494An information disclosure vulnerability exists in Canonical …5.5
• CVE-2026-9495Versions of the package @koa/router from 14.0.0 and before 1…7.3
• CVE-2026-9496Versions of the package pacote from 11.2.7 and before 21.5.1…7.7
• CVE-2026-9497A flaw has been found in changmingxie tcc-transaction up to …6.3
• CVE-2026-9498A vulnerability has been found in Dromara lamp-cloud up to 5…6.3
• CVE-2026-9500A vulnerability was found in GNU LibreDWG up to 0.14. The af…5.3
• CVE-2026-9501A vulnerability was determined in GNU LibreDWG up to 0.14. T…3.3
• CVE-2026-9502A vulnerability was identified in GNU LibreDWG up to 0.14. T…5.3
• CVE-2026-9503A security flaw has been discovered in GNU LibreDWG up to 0.…3.3
• CVE-2026-9504A weakness has been identified in GNU LibreDWG up to 0.14. A…3.3
• CVE-2026-9506This vulnerability exists in Bagisto due to improper validat…8.7