Description
An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.
Published: 2026-11-04
Score: 1.7 Low
EPSS: n/a
KEV: No
Impact: Denial of Service (application crash)
Action: Apply Patch
AI Analysis

Impact

An integer truncation flaw in the QTextCodec conversion functions of Qt’s 5 Core Compatibility APIs can cause the target application to terminate abruptly. The weakness is a classic integer truncation error (CWE-197) that can lead to a denial‑of‑service condition within the affected module.

Affected Systems

The flaw affects the Qt Framework, specifically the 5 Core Compatibility APIs module of the Qt product family. No explicit version ranges are listed, so any installation that includes the vulnerable QTextCodec conversion code in Qt needs review. The known affected identifiers include any cpe:2.3:a:qt:qt5compat, cpe:2.3:a:qt:qt and cpe:2.3:a:qt:qtbase.

Risk and Exploitability

The assigned CVSS score of 1.7 indicates a low severity impact. There is no EPSS score available, and the vulnerability is not present in the CISA KEV catalog, suggesting low exploitation potential. Based on the information provided, the likely attack vector is an application that exercises the affected QTextCodec conversion functionality; an attacker would likely need to supply crafted data that triggers the integer truncation during conversion, resulting in a crash.

Generated by OpenCVE AI on November 4, 2026 at 13:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure the Qt installation is upgraded to the latest version that includes the integer truncation fix for the QTextCodec conversion API.
  • If the application cannot be immediately updated, remove or replace all calls to the vulnerable conversion functions or add defensive checks around them.
  • Validate or sanitize input before it reaches the conversion routine to reduce the likelihood of a crash, and monitor application logs for unexpected terminations.

Generated by OpenCVE AI on November 4, 2026 at 13:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Description An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt Framework. An application using the affected functionality could crash.
Title Integer truncation vulnerability in QTextCodec conversion functions impacts Qt Framework
First Time appeared Qt
Qt qt
Qt qt5compat
Qt qtbase
Weaknesses CWE-197
CPEs cpe:2.3:a:qt:qt5compat:*:*:*:*:*:*:*:*
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*
Vendors & Products Qt
Qt qt
Qt qt5compat
Qt qtbase
References
Metrics cvssV4_0

{'score': 1.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/RE:L/U:Green'}

Subscriptions

Qt Qt Qt5compat Qtbase
cve-icon MITRE

Status: PUBLISHED

Assigner: Qt

Published:

Updated: 2026-11-04T12:10:28.423Z

Reserved: 2026-10-08T07:59:02.714Z

Link: CVE-2026-107479

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T13:17:21.540

Modified: 2026-11-04T13:17:21.540

Link: CVE-2026-107479

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T13:15:14Z

Weaknesses