CVE-2026-107590

EUVD-2026-110826
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
QtCNA
1.9 LOW
LOCAL
LOW
NONE
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
qtqt
4.5.0 ≤
𝑥
≤ 6.8.8
CNA
qtqt
6.9.0 ≤
𝑥
≤ 6.11.2
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://codereview.qt-project.org/c/qt/qt5compat/+/762752
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107590: