CVE-2026-103645 · Package
NO FIX YET
Qt's QTextCodec fromUnicode() and toUnicode() functions contain an integer overflow. Only Qt builds compiled with ICU support are affected.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built on Qt 5 or Qt 6 that are compiled with ICU support are affected, per the description. Builds without ICU are not affected. The sources do not name fixed versions or the exact trigger path.
Not affected if no-icu-build
Who cares c++, desktop-apps, qt
qmake --version (unknown which versions are affected)No fix yet, per the sources.
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Clear
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.