The vulnerability is an out‑of‑bounds write in Qt’s QTextCodec iconv‑based encoding. It is caused by an incorrect buffer length calculation (CWE‑131) that allows the write to extend beyond the allocated memory (CWE‑787). When triggered, the application may experience a crash and data integrity problems, as the overwritten data may be corrupted.

Qt products are affected, specifically the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier). The bug exists in all Qt 5 releases and earlier versions, as the references target the Qt 5 Compatibility APIs module. No specific sub‑versions are listed, but any Qt 5 build that incorporates the legacy QTextCodec implementation is impacted.

The CVSS score of 1.9 reflects a low severity, and the EPSS score is not available, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker could supply malicious or malformed input to an application that uses QTextCodec. The bug can be triggered by encoding operations, meaning that untrusted data flowing into an application that relies on QTextCodec could provoke the out‑of‑bounds write, leading to a crash and potential data corruption.