---
id: CVE-2026-107472
title: Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
summary: >-
  An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt
  5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt.
  Applications that convert text to the TSCII encoding through QTextCodec may
  read memory …
severity: medium
cvss: 4.3
cvssVector: >-
  CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green
cvssSource: cna
cwe:
  - CWE-125
vendor: qt
product: Qt
affected:
  - Qt >= 4.0.0 <= 6.8.8
  - Qt >= 6.9.0 <= 6.11.2
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T07:32:31.991Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107472'
references:
  - url: >-
      https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107472:
  - url: 'https://codereview.qt-project.org/c/qt/qt5compat/+/762021'
tags:
  - cve.org
epss: 0.0012
epssPercentile: 0.01814
ingestedAt: '2026-10-27T16:11:59.240Z'
---

## Overview

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

## Affected

- `Qt >= 4.0.0 <= 6.8.8`
- `Qt >= 6.9.0 <= 6.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.