CVE-2026-103645
Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt
CVE-2026-103645 is a low vulnerability (CVSS 1.1) in Qt, published November 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
- Severity
- 1.1 LowCVSS 4.0, CVE List
- Exploit chance
- 0.17%EPSS, 6th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qtbase-opensource-srcUbuntu:Pro:16.04:LTS | All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 15 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2 | None known |
qtbase-opensource-src-glesUbuntu:16.04:LTS | All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu15.5.1+dfsg-10ubuntu15.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 9 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu45.5.1+dfsg-16ubuntu55.5.1+dfsg-16ubuntu6 | None known |
qtbase-opensource-srcUbuntu:Pro:18.04:LTS | All versions, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 12 moreShow less5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2 | None known |
qtbase-opensource-srcUbuntu:Pro:20.04:LTS | All versions, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 6 moreShow less5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4 | None known |
qtbase-opensource-src-glesUbuntu:20.04:LTS | All versions, plus listed versions 5.12.4+dfsg-1build15.12.5+dfsg-15.12.5+dfsg-25.12.8+dfsg-0ubuntu1 | None known |
qt6-5compatUbuntu:22.04:LTS | All versions, plus listed versions 6.2.2-56.2.4-1 | None known |
qtbase-opensource-src-glesUbuntu:22.04:LTS | All versions, plus listed versions 5.15.2+dfsg-45.15.2+dfsg-55.15.3+dfsg-1 | None known |
qtbase-opensource-srcUbuntu:Pro:22.04:LTS | All versions, plus listed versions 5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3 Show 8 moreShow less5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3 | None known |
qt6-5compatUbuntu:24.04:LTS | All versions, plus listed versions 6.4.2-36.4.2-46.4.2-4build16.4.2-4build26.4.2-4build3 | None known |
qtbase-opensource-src-glesUbuntu:24.04:LTS | All versions, plus listed versions 5.15.10+dfsg-25.15.10+dfsg-35.15.12+dfsg-15.15.12+dfsg-1ubuntu15.15.12+dfsg-1ubuntu25.15.13+dfsg-1 | None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtbase-opensource-srcUbuntu:Pro:24.04:LTS | All versions, plus listed versions 5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1 Show 4 moreShow less5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1 | None known |
qt6-5compatUbuntu:26.10 | All versions, plus listed versions 6.10.2-16.10.2-36.10.2-46.11.2-1 | None known |
qtbase-opensource-srcUbuntu:26.10 | All versions, plus listed versions 5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2 | None known |
qtbase-opensource-src-glesUbuntu:26.10 | All versions, plus listed versions 5.15.18+dfsg-15.15.19+dfsg-2 | None known |
qt6-5compatUbuntu:26.04:LTS | All versions, plus listed versions 6.9.2-16.9.2-36.9.2-3build16.10.2-1 | None known |
qtbase-opensource-srcUbuntu:26.04:LTS | All versions, plus listed versions 5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1 | None known |
qtbase-opensource-src-glesUbuntu:26.04:LTS | All versions, plus listed versions 5.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-1 | None known |
What each source reports
CVE List Score used
Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
- Record
CVE-2026-103645- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear - Weakness
- CWE-190, CWE-835
- Updated
- 2026-11-13
EUVDEUVD-2026-125217
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
- Record
EUVD-2026-125217- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-c62h-jfxc-cpph
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode()...
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
- Record
GHSA-c62h-jfxc-cpph- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Clear - Weakness
- CWE-190
- Updated
- 2026-11-13
NVD
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
- Record
CVE-2026-103645- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Clear - Weakness
- CWE-190, CWE-835
- Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-103645
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
- Record
UBUNTU-CVE-2026-103645- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| aliases, products, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.