{"id":"CVE-2026-107472","kind":"vulnerability","aliases":["CVE-2026-107472"],"related":[],"title":"Qt: out-of-bounds read in TSCII text encoding can crash applications","description":"An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.","summary":"The Qt 5 Compatibility APIs module has an out-of-bounds read in its QTextCodec TSCII encoder. Applications that convert text to TSCII through QTextCodec may read memory past the input buffer, which can crash them or misread the data.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","desktop-apps","package","qt"],"not_affected_if":["no-tscii-usage","qt6-only"],"how_to_check":"- Check whether the application links Qt 5 (Qt Core 5 and earlier) and calls QTextCodec with the TSCII codec, for example by searching the source for `TSCII` or `QTextCodec::codecForName`.\n- unknown for whether a specific installed Qt build is patched; the sources do not list fixed versions.","fix":"- unknown: the sources do not name a fixed Qt version or patch. Check the Qt project advisory for the release that corrects this issue and move the Qt 5 build to it.\n- Until patched, avoid converting text to TSCII through QTextCodec on untrusted input.","status":"open","published_at":"2026-10-27T08:16:52+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","triaged_at":"2026-10-27T08:32:38+00:00","updated_at":"2026-10-27T08:32:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T08:32:38Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed Qt version or patch. Check the Qt project advisory for the release that corrects this issue and move the Qt 5 build to it.\n- Until patched, avoid converting text to TSCII through QTextCodec on untrusted input.","reach":"unknown","title":"Qt: out-of-bounds read in TSCII text encoding can crash applications","impact":"low","summary":"The Qt 5 Compatibility APIs module has an out-of-bounds read in its QTextCodec TSCII encoder. Applications that convert text to TSCII through QTextCodec may read memory past the input buffer, which can crash them or misread the data.","category":"package","nicknames":[],"who_cares":["qt","c++","desktop-apps"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Application crashes or processes misread memory contents from outside the buffer","analyst_note":"Find the Qt project advisory or NVD entry for CVE-2026-107472 to confirm fixed Qt 5 versions and whether attacker-controlled input can reach the TSCII path.","how_to_check":"- Check whether the application links Qt 5 (Qt Core 5 and earlier) and calls QTextCodec with the TSCII codec, for example by searching the source for `TSCII` or `QTextCodec::codecForName`.\n- unknown for whether a specific installed Qt build is patched; the sources do not list fixed versions.","needs_analyst":true,"not_affected_if":["no-tscii-usage","qt6-only"],"who_is_affected":"Applications built on Qt 5 that use the QTextCodec TSCII encoding to convert text, most often when handling user-supplied text in Tamil-language encodings. Applications that do not use TSCII conversion, or that run only on Qt 6, are not affected by this description.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3357,"output_tokens":668,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107472':16A,19A '-2026':15A,18A '5':28B,82C,90C 'api':30B,84C 'app':23B 'applic':13A,44B,95C,116C 'bound':5A,37B,71C 'buffer':58B,111C 'c':20B 'caus':114C 'compat':29B,83C 'convert':46B,97C 'core':87C 'crash':12A,61B,118C 'cve':14A,17A 'data':66B,122C 'desktop':22B 'desktop-app':21B 'earlier':92C 'encod':10A,43B,78C,102C 'impact':93C 'input':57B,110C 'may':52B,105C 'memori':54B,107C 'misinterpret':120C 'misread':64B 'modul':31B,85C 'out-of-bound':2A,34B,68C 'outsid':108C 'packag':24B 'past':55B 'qt':1A,25B,27B,81C,86C,89C,94C 'qtextcodec':41B,51B,76C,104C 'read':6A,38B,53B,72C,106C 'text':9A,47B,98C 'tscii':8A,42B,49B,77C,101C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Qt 5 that use the QTextCodec TSCII encoding to convert text, most often when handling user-supplied text in Tamil-language encodings. Applications that do not use TSCII conversion, or that run only on Qt 6, are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107472","severity":null,"published_at":"2026-10-27T08:16:52+00:00","modified_at":"2026-10-27T08:16:52+00:00","first_seen_at":"2026-10-27T08:31:46+00:00","fetched_at":"2026-10-27T08:31:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}