OESA-2026-4671: qt6-qt5compat security update
. Security Fix(es):
An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.(CVE-2026-107472)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/qt6-qt5compatto a version that resolves this vulnerability.Fixed in 6.5.2-4.oe2403sp3
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the Qt 5 Compatibility APIs module that convert text to the TSCII encoding through QTextCodec are affected. Applications that do not perform QTextCodec TSCII conversion are not identified as affected by the available information.
What would exploitation require?
The vulnerability is rated with local attack vector and requires user interaction; no privileges are required. The available information does not specify the exact form of attacker-controlled input or interaction needed.
What is the likely impact?
Reading outside the input buffer can cause an application to crash or misinterpret converted data. The supplied vector identifies availability impact, with no stated confidentiality or integrity impact.