CVE-2026-103645: Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt
Published Nov 13, 2026
·Updated
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
Event History
Nov 13, 2026
CVE Published
via MITRE·09:36 AM
Data Sourced
via MITRE·09:36 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Qt builds are affected?
Only builds compiled with ICU support are affected. The issue is in QTextCodec fromUnicode() and toUnicode() in the Qt 5 Core Compatibility APIs module for Qt 6 and the Qt Core module for Qt 5.
2
Does exploiting this issue require remote access or prior authentication?
The supplied vector indicates local attack access, no privileges required, and user interaction is required. It does not indicate a remote network attack path.
3
What is the expected security impact?
The supplied severity is low, with no confidentiality or integrity impact indicated and low availability impact indicated.