CVE-2026-103645

EUVD-2026-125217
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
QtCNA
1.1 LOW
LOCAL
LOW
NONE
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Clear
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.67%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
qtqt
5.0.0 ≤
𝑥
< 6.8.9
CNA
qtqt
6.9.0 ≤
𝑥
< 6.11.3
CNA
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qt6-5compat
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
qtbase-opensource-src
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
qtbase-opensource-src-gles
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://codereview.qt-project.org/c/qt/qt5compat/+/762795
https://www.qt.io/security-advisories?search=CVE-2026-103645