CVE-2026-107479
Description
A flaw was found in Qt. An integer truncation vulnerability in the QTextCodec conversion functions of the Core Compatibility APIs module can cause an application crash, leading to a Denial of Service (DoS). A local attacker could exploit this flaw by tricking a user into processing specially crafted data, causing the application to terminate unexpectedly.
Statement
An integer truncation flaw was found in the Qt QTextCodec conversion functions (qt5compat/Qt 5 Core Compatibility APIs; qtbase in Qt 5). A local attacker could trick a user into processing specially crafted data, causing a Qt application to crash (denial of service). RH rated this MODERATE (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H); the upstream CVSS4 score (1.7) differs due to CVSS version and AC/UI metric choices. Fixed upstream in Qt 6.8.9, 6.11.3, and 6.12.0.
Mitigation
No specific mitigation; users can avoid opening untrusted data with Qt applications that use QTextCodec conversion functions. Updating to a Qt version containing the fix (6.8.9/6.11.3/6.12.0) resolves the issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Other,Integrity
Technical Impact: Unexpected State; Quality Degradation
The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
