CVE-2026-107590

LowCVSS 1.9/10Last modified Nov 4, 2026

Description

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and may affect data integrity.

Metrics

CVSS 4.0 1.9/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green

Weakness enumeration

CWE-131 CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
qt	Qt	>= 4.5.0, <= 6.8.8; >= 6.9.0, <= 6.11.2

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-10759410.0The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data CVE-2026-1075975.1PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the CVE-2026-10764.3The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This i CVE-2026-1076027.5A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs whe CVE-2026-1076044.9A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm adminis CVE-2026-1076056.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could al CVE-2026-1076066.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could al CVE-2026-1076076.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could al CVE-2026-1076085.5Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-de CVE-2026-1076117.1An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromi CVE-2026-1076127.8Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite CVE-2026-1076135.9A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an a