Bug 2503641 (CVE-2026-9499) - CVE-2026-9499 qt: Qt: Denial of Service via out-of-bounds read in text codec handling
Summary: CVE-2026-9499 qt: Qt: Denial of Service via out-of-bounds read in text codec ...
Keywords:
Status: NEW
Alias: CVE-2026-9499
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2521831 2521832 2521833 2521834 2521835
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-21 14:01 UTC by OSIDB Bzimport
Modified: 2026-10-01 10:39 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:65816 0 None None None 2026-09-09 06:56:14 UTC
Red Hat Product Errata RHSA-2026:65897 0 None None None 2026-09-09 10:38:03 UTC
Red Hat Product Errata RHSA-2026:65993 0 None None None 2026-09-09 14:04:09 UTC
Red Hat Product Errata RHSA-2026:70560 0 None None None 2026-09-23 19:46:15 UTC
Red Hat Product Errata RHSA-2026:70561 0 None None None 2026-09-23 06:22:22 UTC
Red Hat Product Errata RHSA-2026:70562 0 None None None 2026-09-23 07:41:17 UTC
Red Hat Product Errata RHSA-2026:72376 0 None None None 2026-09-28 06:42:22 UTC
Red Hat Product Errata RHSA-2026:72377 0 None None None 2026-09-28 06:49:57 UTC
Red Hat Product Errata RHSA-2026:72378 0 None None None 2026-09-28 06:53:50 UTC
Red Hat Product Errata RHSA-2026:72383 0 None None None 2026-09-28 07:20:36 UTC
Red Hat Product Errata RHSA-2026:74444 0 None None None 2026-10-01 10:39:14 UTC

Description OSIDB Bzimport 2026-07-21 14:01:33 UTC 
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
Comment 3 errata-xmlrpc 2026-09-09 06:56:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65816 https://access.redhat.com/errata/RHSA-2026:65816
Comment 4 errata-xmlrpc 2026-09-09 10:38:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:65897 https://access.redhat.com/errata/RHSA-2026:65897
Comment 5 errata-xmlrpc 2026-09-09 14:04:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:65993 https://access.redhat.com/errata/RHSA-2026:65993
Comment 7 Jon Orris 2026-09-23 06:22:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:70561 https://access.redhat.com/errata/RHSA-2026:70561
Comment 8 Jon Orris 2026-09-23 07:41:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:70562 https://access.redhat.com/errata/RHSA-2026:70562
Comment 9 Jon Orris 2026-09-23 19:46:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:70560 https://access.redhat.com/errata/RHSA-2026:70560
Comment 10 Jon Orris 2026-09-28 06:42:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:72376 https://access.redhat.com/errata/RHSA-2026:72376
Comment 11 Jon Orris 2026-09-28 06:49:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:72377 https://access.redhat.com/errata/RHSA-2026:72377
Comment 12 Jon Orris 2026-09-28 06:53:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:72378 https://access.redhat.com/errata/RHSA-2026:72378
Comment 13 Jon Orris 2026-09-28 07:20:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:72383 https://access.redhat.com/errata/RHSA-2026:72383
Comment 14 Jon Orris 2026-10-01 10:39:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:74444 https://access.redhat.com/errata/RHSA-2026:74444
Note You need to log in before you can comment on or make changes to this bug.