CVE-2026-9499: 
Qt vulnerability analysis and mitigation

CVE-2026-9499 is an out-of-bounds read (buffer over-read) vulnerability in Qt's QTextCodec::codecForName() function. When the function receives a QByteArray that is not NUL-terminated (e.g., created via QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. The vulnerability affects Qt 4.x and 5.x (Qt Core/qtbase) and Qt 6.0.0 through 6.8.7 and 6.9.0 through 6.11.0 (Qt5Compat module); Qt 6.8.8+ and 6.11.1+ are patched. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). The codec-name matching routine in QTextCodec::codecForName() does not enforce a NUL terminator boundary when iterating over the input QByteArray, causing it to read beyond the allocated buffer. The over-read is bounded by the length of the longest codec-name candidate in Qt's internal fixed list, and the out-of-bounds bytes are only compared against that static list — meaning no attacker-controlled data is disclosed. Exploitation requires that an application code path passes a non-NUL-terminated QByteArray (such as one constructed with QByteArray::fromRawData()) to the vulnerable function; applications that always pass properly NUL-terminated arrays are not affected (GitHub Advisory). Patch commits are available in the Qt5Compat code review system (Qt Code Review).

The primary impact is availability: in most cases, the over-read causes an incorrect text codec to be selected, leading to silent misbehavior in text encoding/decoding. In the worst case, if the over-read reaches unmapped memory, the process crashes, resulting in a denial of service. There is no confidentiality impact, as the out-of-bounds bytes are only compared internally against Qt's fixed codec-name list and are never disclosed to an attacker; integrity impact is limited to the low-severity consequence of incorrect codec selection (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.301% (22nd percentile), indicating a low probability of exploitation in the near term. CVE-2026-9499 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that attacker-influenced input must reach the specific QTextCodec::codecForName() call path with a non-NUL-terminated buffer (GitHub Advisory).

Qt has released patched versions: 6.8.8 (for the 6.0.0–6.8.x branch) and 6.11.1 (for the 6.9.0–6.11.x branch); Qt 4.x and 5.x users should consult vendor-specific backport availability (GitHub Advisory). As a code-level workaround, developers should ensure that all QByteArray objects passed to QTextCodec::codecForName() are properly NUL-terminated — avoid using QByteArray::fromRawData() for this purpose unless the underlying buffer is guaranteed to be NUL-terminated. Patch commits for the Qt5Compat module are available for review at the Qt project code review system (Qt Code Review).

Qt published an official security advisory blog post describing the vulnerability and its limited impact (Qt Blog). Coverage was picked up by standard vulnerability aggregators including VulDB, Vulners, and ENISA's EUVD shortly after disclosure, with no notable researcher controversy or significant community debate observed. The vulnerability's moderate severity and constrained exploitability conditions appear to have limited broader security community discussion.