{"id":"CVE-2026-107590","kind":"vulnerability","aliases":["CVE-2026-107590"],"related":[],"title":"Qt 5: encoding text with QTextCodec can write outside a buffer","description":"An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.","summary":"In the Qt 5 Compatibility APIs module, QTextCodec's iconv-based encoding can write past an internal buffer under certain conditions. The sources say this can crash the application and may affect data integrity.","severity":"low","cvss":1.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","qt","qt5"],"not_affected_if":["qt6"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T13:16:54+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:23+00:00","updated_at":"2026-10-27T13:32:23+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T13:32:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Qt 5: encoding text with QTextCodec can write outside a buffer","impact":"low","summary":"In the Qt 5 Compatibility APIs module, QTextCodec's iconv-based encoding can write past an internal buffer under certain conditions. The sources say this can crash the application and may affect data integrity.","category":"package","nicknames":[],"who_cares":["qt","qt5","c++"],"confidence":0.5,"needs_auth":"unknown","worst_case":"application crashes; data integrity may be affected","analyst_note":"Check the NVD entry and the Qt advisory for the affected versions, the exact trigger conditions, and the fixed Qt 5 release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["qt6"],"who_is_affected":"Applications built on Qt 5 and earlier that encode text through QTextCodec with the iconv-based codec. The sources do not say which configurations or platforms trigger the condition. Teams on Qt 6 or on Qt 5 builds without this codec path can likely skip it, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000552,"input_tokens":3353,"output_tokens":433,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-107590':14A,17A '-2026':13A,16A '5':2A,25B,75C,83C 'affect':54B,110C 'api':27B,77C 'applic':51B,105C 'base':33B,70C 'bound':61C 'buffer':11A,40B,100C 'c':18B 'caus':103C 'certain':42B,89C 'compat':26B,76C 'condit':43B,90C 'core':80C 'crash':49B,107C 'cve':12A,15A 'data':55B,111C 'earlier':85C 'encod':3A,34B,71C,91C 'iconv':32B,69C 'iconv-bas':31B,68C 'impact':86C 'integr':56B,112C 'intern':39B,99C 'may':53B,95C,109C 'modul':28B,78C 'out-of-bound':58C 'outsid':9A,97C 'packag':19B 'past':37B 'qt':1A,20B,24B,66C,74C,79C,82C,87C 'qt5':21B 'qtextcodec':6A,29B,67C,94C 'say':46B 'sourc':45B 'text':4A,92C 'vulner':63C 'write':8A,36B,62C,96C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Qt 5 and earlier that encode text through QTextCodec with the iconv-based codec. The sources do not say which configurations or platforms trigger the condition. Teams on Qt 6 or on Qt 5 builds without this codec path can likely skip it, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107590","severity":null,"published_at":"2026-10-27T13:16:54+00:00","modified_at":"2026-10-27T13:16:54+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}