CVE-2026-9499: Qt QTextCodec Buffer Over-Read Vulnerability

CVE-2026-9499 Overview

CVE-2026-9499 is an out-of-bounds read vulnerability in the QTextCodec::codecForName() function in the Qt framework. The flaw occurs when the function receives a QByteArray that is not NUL-terminated, such as one created with QByteArray::fromRawData(). The codec-name matching routine reads past the end of the supplied buffer while comparing bytes against Qt's fixed list of codec names. The vulnerability affects the Qt5Compat module from Qt 6.0.0 onward and Qt Core (qtbase) in Qt 4.x and Qt 5.x. The issue is classified under CWE-125 (Out-of-Bounds Read).

Critical Impact
The over-read can cause incorrect codec selection or trigger a process crash if the read reaches unmapped memory, resulting in denial of service. No attacker-controlled data disclosure occurs because compared bytes remain internal to Qt.

Affected Products

Qt 4.x — qtbase (Qt Core module)
Qt 5.x — qtbase (Qt Core module)
Qt 6.0.0 and later — Qt5Compat module

Discovery Timeline

2026-07-21 - CVE-2026-9499 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9499

Vulnerability Analysis

The QTextCodec::codecForName() function accepts a QByteArray argument identifying the desired text codec. Qt's internal implementation walks its fixed table of known codec names and compares the supplied byte sequence against each candidate. The matching logic assumes the input buffer is NUL-terminated or extends at least as far as the longest codec name.

When callers pass a QByteArray constructed via QByteArray::fromRawData(), the underlying storage may not include a trailing NUL byte. The comparison routine then reads beyond the buffer boundary, up to the length of the longest codec-name candidate in Qt's internal table.

In typical execution, the over-read returns arbitrary adjacent memory content, causing an incorrect codec to be selected. If the adjacent memory sits on an unmapped page, the process faults and terminates. The vulnerability does not disclose data to the attacker because the out-of-bounds bytes are only compared internally against Qt's codec name list.

Root Cause

The root cause is missing input validation on the length and termination of the input QByteArray before iterating through the codec-name matching table. The routine treats the buffer as a C-style string without verifying explicit length bounds against each candidate string comparison.

Attack Vector

Exploitation requires an application to invoke QTextCodec::codecForName() with attacker-influenced, non-NUL-terminated byte arrays. Applications that construct QByteArray values with QByteArray::fromRawData() from untrusted sources are exposed. Applications that only pass NUL-terminated QByteArrays are not affected. The primary impact is denial of service through process termination.

No verified public exploit code is available. See the Qt Code Review patch submissions for the technical fix details.

Detection Methods for CVE-2026-9499

Indicators of Compromise

Unexpected crashes in applications linking against Qt5Compat or qtbase, with faults originating in codec-name lookup routines.
Incorrect text rendering or encoding mismatches in Qt-based applications processing external string data.
Segmentation faults referencing QTextCodec::codecForName in crash reports or core dumps.

Detection Strategies

Perform static analysis of Qt application source code for calls to QTextCodec::codecForName() receiving input from QByteArray::fromRawData() or other non-NUL-terminated constructors.
Run fuzz testing against Qt applications with non-NUL-terminated byte arrays supplied to codec-selection paths.
Enable AddressSanitizer (ASan) during development and QA to surface the out-of-bounds read at runtime.

Monitoring Recommendations

Aggregate application crash telemetry and correlate segmentation faults involving Qt codec functions.
Track deployed Qt module versions across endpoints to identify systems running affected qtbase or Qt5Compat builds.
Monitor Qt security advisories and the referenced Qt code review submissions for patch propagation to downstream distributions.

How to Mitigate CVE-2026-9499

Immediate Actions Required

Inventory applications and container images that ship or link against Qt Core (qtbase) or Qt5Compat modules.
Audit application code paths that call QTextCodec::codecForName() and verify the QByteArray argument is NUL-terminated before invocation.
Prioritize remediation for applications that pass externally supplied data into codec lookup routines.

Patch Information

The fix has been submitted through the Qt code review process. Refer to the upstream patches: qt5compat 723911, qt5compat 724348, qt5compat 724995, and tqtc-qt5compat 725112. Apply vendor-provided Qt updates once available in your Linux distribution or Qt commercial release channel.

Workarounds

Convert any QByteArray created via QByteArray::fromRawData() to a fully owned, NUL-terminated copy before passing it to QTextCodec::codecForName().
Validate codec name length against Qt's known codec set at the application layer prior to lookup.
Restrict codec name inputs to a strict allow-list of known values instead of accepting arbitrary user-supplied identifiers.

bash

# Configuration example
# Rebuild affected Qt modules from patched source once available:
# git fetch https://codereview.qt-project.org/qt/qt5compat refs/changes/11/723911/1
# git checkout FETCH_HEAD
# cmake --build . --target install