---
id: "CVE-2026-107472"
kind: "vulnerability"
aliases: ["CVE-2026-107472"]
title: "Qt: out-of-bounds read in TSCII text encoding can crash applications"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "desktop-apps", "package", "qt"]
not_affected_if: ["no-tscii-usage", "qt6-only"]
published_at: "2026-10-27T08:16:52+00:00"
first_seen_at: "2026-10-27T08:31:46+00:00"
updated_at: "2026-10-27T08:32:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107472", "first_seen_at": "2026-10-27T08:31:46+00:00"}]
---

# Qt: out-of-bounds read in TSCII text encoding can crash applications

The Qt 5 Compatibility APIs module has an out-of-bounds read in its QTextCodec TSCII encoder. Applications that convert text to TSCII through QTextCodec may read memory past the input buffer, which can crash them or misread the data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application links Qt 5 (Qt Core 5 and earlier) and calls QTextCodec with the TSCII codec, for example by searching the source for `TSCII` or `QTextCodec::codecForName`.
- unknown for whether a specific installed Qt build is patched; the sources do not list fixed versions.

## Fix

- unknown: the sources do not name a fixed Qt version or patch. Check the Qt project advisory for the release that corrects this issue and move the Qt 5 build to it.
- Until patched, avoid converting text to TSCII through QTextCodec on untrusted input.

## Timeline

- 2026-10-27T08:31:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107472

## From the sources

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_