Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt

A medium-severity out-of-bounds read vulnerability (CVE-2026-9499) has been discovered in QTextCodec::codecForName() within Qt's Qt5Compat module. The flaw affects Qt versions from 4.0.0 through 6.8.7 and 6.9.0 through 6.11.0. Passing a non-NUL-terminated QByteArray created via QByteArray::fromRawData() can cause the codec-name matching routine to read past the buffer end, potentially resulting in an incorrect codec match or application crash (denial of service). No user data is exposed. The fix is to upgrade to Qt 6.8.8 or Qt 6.11.1, or apply the provided patches for versions 6.9, 6.8, and 6.5.