The vulnerability is an out-of-bounds read in Qt's QTextCodec::codecForName() when called with a non‑NUL‑terminated QByteArray. This causes the codec‑name matching routine to read past the supplied buffer. In most scenarios the application ends up selecting an incorrect text codec; in the worst case, an over‑read that reaches unmapped memory can crash the process, resulting in a denial‑of‑service condition. The fault is a buffer over‑read (CWE‑125) and does not expose application data to an attacker.

Qt products including Qt 4.x, Qt 5.x, and Qt 6.0.0 and later are affected. The faulty code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x. Any application that links against these modules and invokes QTextCodec::codecForName() with non‑NUL‑terminated input is exposed.

The CVSS score is 6.3, indicating moderate severity, while the EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, pointing to a low likelihood of exploitation in the wild. The flaw requires the attacker to supply crafted input that triggers a non‑NUL‑terminated QByteArray to the codec selection routine, so exploitation is limited to environments where that function is exposed to untrusted data. The primary impact remains a denial‑of‑service via process crash, with no direct data disclosure.