CVE-2026-9499: qt Out-of-bounds Read

CVSS: 6.3v4.0MediumDeferred

AliasesRHSA-2026:41389RHSA-2026:65816RHSA-2026:65897+11 more

Published 21-07-2026Last modified 22-07-2026

Vulnerability summary

CVE-2026-9499 is a medium (CVSS 6.3) Out-of-bounds Read vulnerability in qt. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.3/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

21-07-2026
PublishedVulnerability first disclosed.
22-07-2026
Last modifiedVulnerability information updated.

Description

An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

CVSS metrics

5 scores · 5 sources · 2 versions

v4.06.3v3.17.5

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

0.00 pp

From 0.30% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Redhat45 products

qt< 1:4.8.7-10.el7_9
qt-assistant< 1:4.8.7-10.el7_9
qt-config< 1:4.8.7-10.el7_9
qt-debuginfo< 1:4.8.7-10.el7_9
qt-demos< 1:4.8.7-10.el7_9

qt-devel< 1:4.8.7-10.el7_9
qt-devel-private< 1:4.8.7-10.el7_9
qt-doc< 1:4.8.7-10.el7_9
qt-examples< 1:4.8.7-10.el7_9
qt-mysql< 1:4.8.7-10.el7_9
qt-odbc< 1:4.8.7-10.el7_9
qt-postgresql< 1:4.8.7-10.el7_9
qt-qdbusviewer< 1:4.8.7-10.el7_9
qt-qvfb< 1:4.8.7-10.el7_9
qt-x11< 1:4.8.7-10.el7_9
qt5-qtbase< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-common< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-debugsource< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-devel< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-devel-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-examples< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-examples-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-gui< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-gui-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-mysql< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-mysql-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-odbc< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-odbc-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-postgresql< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-postgresql-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-private-devel< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-static< 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt5-qtbase-tests-debuginfo< 0:5.12.5-9.el8_4.1 | < 0:5.15.2-5.el8_6.1 | < 0:5.15.3-2.el8_8.1 | < 0:5.15.3-2.el9_2.1 | < 0:5.15.9-11.el9_4.1 | < 0:5.15.9-11.el9_6.1 | < 0:5.15.3-9.el8_10 | < 0:5.15.9-11.el9_8.1
qt6< 0:6.11.1-2.hum1
qt6-filesystem< 0:6.11.1-2.hum1
qt6-qt5compat< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-debuginfo< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-debugsource< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-devel< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-examples< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-examples-debuginfo< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-qt5compat-tests-debuginfo< 0:6.8.1-1.el10_0.1 | < 0:6.10.1-1.el10_2.1
qt6-rpm-macros< 0:6.11.1-2.hum1
qt6-srpm-macros< 0:6.11.1-2.hum1

Show all 45

Debian2 products

qt6-5compatAll versions (No fix recorded) | < 6.10.2-4
qtbase-opensource-srcAll versions (No fix recorded) | < 5.15.19+dfsg-4

Ubuntu2 products

qt6-5compatAll versions (No fix recorded)
qtbase-opensource-srcAll versions (No fix recorded)

Qt1 product

qt≥ 6.0.0, < 6.8.8 | ≥ 6.9.0, < 6.11.1 | ≥ 4.0.0, < 6.0.0

4 vendors · 50 products

References

37 links

codereview.qt-project.org/c/qt/qt5compat/+/723911PatchARTICLEREPORT
codereview.qt-project.org/c/qt/qt5compat/+/724348PatchARTICLEREPORT
codereview.qt-project.org/c/qt/qt5compat/+/724995PatchARTICLEREPORT
codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112PatchARTICLE
access.redhat.com/errata/RHSA-2026:41389Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-9499REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41389.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2503641REPORT

Show all 37 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities