CVE-2026-107590

medium

Description

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107590:

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110826

https://codereview.qt-project.org/c/qt/qt5compat/+/762752

Details

Source: Mitre, NVD

Published: 2026-10-27

Updated: 2026-11-04

Risk Information

CVSS v2

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.1

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Severity: High

CVSS v4

Base Score: 5.8

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0012