Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Qt framework is affected, specifically the TSCII text encoding handled by QTextCodec in the Qt 5 Compatibility APIs module and in Qt Core in older releases. Applications that convert text using this encoding can read memory beyond the bounds of their input data, which may crash the application or cause it to process data incorrectly.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- qt Qt
From 4.0.0 · through 6.8.8; From 6.9.0 · through 6.11.2