An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

tuxcare ALMALINUX9.2:CLSA-2026:1789398784: qt5-qtbase: Fix of CVE-2026-9499 (Important)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72376 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72378 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72383 advisory.

    Qt6 - Qt 5 Compatibility Libraries.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72377 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70560 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70562 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70561 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109808 advisory.

    An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1827:02 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1824:01 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65816 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658160 advisory.

    [6.10.1-1.1]
    - Fix out-of-bounds read in QTextCodec::codecForName() (CVE-2026-9499)       Resolves: RHEL-247204

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65897 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65993 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65897 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-659930 advisory.

    [5.15.9-11.1]
    - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName()       Resolves: RHEL-247216

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65993 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658970 advisory.

    [5.15.3-9]
    - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName()       Resolves: RHEL-247206

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65816 advisory.

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65993 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65816 advisory.

    Qt6 - Qt 5 Compatibility Libraries.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65897 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When     the function is called with a QByteArray that is not NUL-terminated (for example, one created with     QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In     most cases this results in an incorrect text codec being selected; in the worst case, if the over-read     reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length     of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's     fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-     terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the     Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. (CVE-2026-9499)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350900	RHEL 8 : qt5-qtbase (RHSA-2026:72376)	Nessus	Red Hat Local Security Checks	Local	medium
350898	RHEL 8 : qt5-qtbase (RHSA-2026:72378)	Nessus	Red Hat Local Security Checks	Local	medium
350892	RHEL 10 : qt6-qt5compat (RHSA-2026:72383)	Nessus	Red Hat Local Security Checks	Local	medium
350890	RHEL 8 : qt5-qtbase (RHSA-2026:72377)	Nessus	Red Hat Local Security Checks	Local	medium
349533	RHEL 9 : qt5-qtbase (RHSA-2026:70560)	Nessus	Red Hat Local Security Checks	Local	medium
349272	RHEL 9 : qt5-qtbase (RHSA-2026:70562)	Nessus	Red Hat Local Security Checks	Local	medium
349271	RHEL 9 : qt5-qtbase (RHSA-2026:70561)	Nessus	Red Hat Local Security Checks	Local	medium
347026	Unity Linux 20.1070-8ae / 20.1070e Security Update: qt5-qtbase (UTSA-2026-109808)	Nessus	Unity Linux Local Security Checks	Local	medium
345713	MiracleLinux 9 : qt5-qtbase-5.15.9-11.el9_8.1 (AXSA:2026-1827:02)	Nessus	Miracle Linux Local Security Checks	Local	medium
345656	MiracleLinux 8 : qt5-qtbase-5.15.3-9.el8_10 (AXSA:2026-1824:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
344579	AlmaLinux 10 : qt6-qt5compat (ALSA-2026:65816)	Nessus	Alma Linux Local Security Checks	Local	medium
344564	Oracle Linux 10 : ELSA-2026-65816-0: / qt6-qt5compat (ELSA-2026-658160)	Nessus	Oracle Linux Local Security Checks	Local	medium
344534	RockyLinux 8 : qt5-qtbase (RLSA-2026:65897)	Nessus	Rocky Linux Local Security Checks	Local	medium
344508	AlmaLinux 9 : qt5-qtbase (ALSA-2026:65993)	Nessus	Alma Linux Local Security Checks	Local	medium
344507	AlmaLinux 8 : qt5-qtbase (ALSA-2026:65897)	Nessus	Alma Linux Local Security Checks	Local	medium
344471	Oracle Linux 9 : ELSA-2026-65993-0: / qt5-qtbase (ELSA-2026-659930)	Nessus	Oracle Linux Local Security Checks	Local	medium
344465	RockyLinux 9 : qt5-qtbase (RLSA-2026:65993)	Nessus	Rocky Linux Local Security Checks	Local	medium
344457	Oracle Linux 8 : ELSA-2026-65897-0: / qt5-qtbase (ELSA-2026-658970)	Nessus	Oracle Linux Local Security Checks	Local	medium
344413	RockyLinux 10 : qt6-qt5compat (RLSA-2026:65816)	Nessus	Rocky Linux Local Security Checks	Local	medium
344326	RHEL 9 : qt5-qtbase (RHSA-2026:65993)	Nessus	Red Hat Local Security Checks	Local	medium
343994	RHEL 10 : qt6-qt5compat (RHSA-2026:65816)	Nessus	Red Hat Local Security Checks	Local	medium
343990	RHEL 8 : qt5-qtbase (RHSA-2026:65897)	Nessus	Red Hat Local Security Checks	Local	medium
329387	Linux Distros Unpatched Vulnerability : CVE-2026-9499	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-9499

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium