--- title: Security advisory: Out-of-bounds read vulnerability in... description: A medium-severity out-of-bounds read vulnerability (CVE-2026-9499) has been discovered in QTextCodec::codecForName() within Qt's Qt5Compat module. The flaw... canonical: https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt | daily.dev og:description: A medium-severity out-of-bounds read vulnerability (CVE-2026-9499) has been discovered in QTextCodec::codecForName() within Qt's Qt5Compat module. The flaw... og:url: https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne og:image: https://api.daily.dev/og/posts/fJd6gfYne.png og:image:alt: Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt **[Qt](https://daily.dev/sources/qt)** · 2 min read · 1 upvotes · 0 comments ## Summary A medium-severity out-of-bounds read vulnerability (CVE-2026-9499) has been discovered in QTextCodec::codecForName() within Qt's Qt5Compat module. The flaw affects Qt versions from 4.0.0 through 6.8.7 and 6.9.0 through 6.11.0. Passing a non-NUL-terminated QByteArray created via QByteArray::fromRawData() can cause the codec-name matching routine to read past the buffer end, potentially resulting in an incorrect codec match or application crash (denial of service). No user data is exposed. The fix is to upgrade to Qt 6.8.8 or Qt 6.11.1, or apply the provided patches for versions 6.9, 6.8, and 6.5. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-9499 in Qt and which versions are affected? CVE-2026-9499 is an out-of-bounds read (buffer over-read) vulnerability in QTextCodec::codecForName() in the Qt5Compat module, with an equivalent flaw in Qt Core going back to Qt 4.0.0. It affects Qt versions from 4.0.0 to 6.8.7 and from 6.9.0 to 6.11.0. It is fixed in Qt 6.8.8 and Qt 6.11.1, with backport patches also available for the 6.9, 6.8, and 6.5 branches. _Teams tracking Qt CVEs across LTS branches can follow patch and upgrade guidance on daily.dev._ ### How is the QTextCodec::codecForName out-of-bounds read triggered and what is the actual impact? It is triggered by passing a non-NUL-terminated QByteArray, such as one created with QByteArray::fromRawData(), into QTextCodec::codecForName(), causing the codec-name matching routine to read past the buffer's end. The over-read is bounded by the longest codec-name candidate and only compared against Qt's internal codec list, so no application or user data is exposed; worst case is an incorrect codec match or an application crash. CVSS 4.0 score is 6.3 (Medium). _Developers assessing real-world exploitability of Qt memory-safety bugs can dig into advisories like this via daily.dev._ ### Is there a workaround for CVE-2026-9499 if I can't upgrade Qt immediately? No practical runtime workaround exists short of applying the patch or upgrading to Qt 6.8.8, Qt 6.11.1, or later. However, applications that do not construct codec-name QByteArrays using QByteArray::fromRawData() are not exposed to this issue and can defer patching with lower urgency. _Engineers weighing patch timing against workaround options for Qt vulnerabilities can track advisories on daily.dev._ ## Similar posts on daily.dev - [Security advisory: Improper validation of tag size in Text component parser in Qt declarative module impacts Qt](https://daily.dev/posts/security-advisory-improper-validation-of-tag-size-in-text-component-parser-in-qt-declarative-module-mzmuipbpt) · Qt · 0 upvotes · 0 comments - [Security advisory: CVE-2026-13326 Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module.](https://daily.dev/posts/security-advisory-cve-2026-13326-out-of-bounds-read-and-integer-underflow-vulnerability-in-qndefnfc-ghlpmanok) · Qt · 0 upvotes · 0 comments - [Security advisory: CVE-2026-76151 out-of-bounds read \(buffer over-read\) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework \(QtNetwork module\)](https://daily.dev/posts/security-advisory-cve-2026-76151-out-of-bounds-read-buffer-over-read-vulnerability-in-http-cache--cgm6o5b0s) · Qt · 0 upvotes · 0 comments - [Security advisory: CVE-2026-79616 Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick](https://daily.dev/posts/security-advisory-cve-2026-79616-out-of-bounds-read-vulnerability-in-context2d-path-and-pathsvg-pat-yhrcppeh1) · Qt · 0 upvotes · 0 comments - [Researchers unearth 30-year-old vulnerability in libpng library](https://daily.dev/posts/researchers-unearth-30-year-old-vulnerability-in-libpng-library-47vswqthb) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#c++](https://daily.dev/tags/c++), [#qt](https://daily.dev/tags/qt) [View this post on daily.dev](https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt","url":"https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne"},"datePublished":"2026-07-21T12:37:03.515Z","dateModified":"2026-09-14T06:26:49.674Z","description":"A medium-severity out-of-bounds read vulnerability (CVE-2026-9499) has been discovered in QTextCodec::codecForName() within Qt's Qt5Compat module. The flaw...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ba7e37aa06724863fcb985328eb4058?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ba7e37aa06724863fcb985328eb4058?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Qt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Qt","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/fe6d7c1f4f824966befd58ee13f9de40","url":"https://daily.dev/sources/qt"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,c++,qt","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Qt","item":"https://daily.dev/sources/qt"},{"@type":"ListItem","position":3,"name":"Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-advisory-out-of-bounds-read-vulnerability-in-qtextcodec-codecforname-in-qt-fjd6gfyne#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-9499 in Qt and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-9499 is an out-of-bounds read (buffer over-read) vulnerability in QTextCodec::codecForName() in the Qt5Compat module, with an equivalent flaw in Qt Core going back to Qt 4.0.0. It affects Qt versions from 4.0.0 to 6.8.7 and from 6.9.0 to 6.11.0. It is fixed in Qt 6.8.8 and Qt 6.11.1, with backport patches also available for the 6.9, 6.8, and 6.5 branches. Teams tracking Qt CVEs across LTS branches can follow patch and upgrade guidance on daily.dev."}},{"@type":"Question","name":"How is the QTextCodec::codecForName out-of-bounds read triggered and what is the actual impact?","acceptedAnswer":{"@type":"Answer","text":"It is triggered by passing a non-NUL-terminated QByteArray, such as one created with QByteArray::fromRawData(), into QTextCodec::codecForName(), causing the codec-name matching routine to read past the buffer's end. The over-read is bounded by the longest codec-name candidate and only compared against Qt's internal codec list, so no application or user data is exposed; worst case is an incorrect codec match or an application crash. CVSS 4.0 score is 6.3 (Medium). Developers assessing real-world exploitability of Qt memory-safety bugs can dig into advisories like this via daily.dev."}},{"@type":"Question","name":"Is there a workaround for CVE-2026-9499 if I can't upgrade Qt immediately?","acceptedAnswer":{"@type":"Answer","text":"No practical runtime workaround exists short of applying the patch or upgrading to Qt 6.8.8, Qt 6.11.1, or later. However, applications that do not construct codec-name QByteArrays using QByteArray::fromRawData() are not exposed to this issue and can defer patching with lower urgency. Engineers weighing patch timing against workaround options for Qt vulnerabilities can track advisories on daily.dev."}}]} ```