Is CVE-2026-107472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107472 being exploited in the wild.

How severe is CVE-2026-107472?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Qt 5 4.0.0 to 6.8.8; 6.9.0 to 6.11.2; Qt 6 6.8.0 to 6.8.8; 6.9.0 to 6.11.2.

Is there a fix for CVE-2026-107472?

Yes: fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107472 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-107472?

Check whether you run Qt 5 or Qt 6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107472: Qt out-of-bounds read in QTextCodec TSCII encoding

CVE-2026-107472 · Severity: info · Published 2026-10-27

Qt is a cross-platform application development framework used to build desktop and mobile applications. An out-of-bounds read vulnerability in the TSCII text encoding conversion feature can cause applications to crash or misinterpret encoded data when processing certain text inputs.

Technologies: Qt 5. Vendors: Qt.

Quick answers

Is CVE-2026-107472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107472 being exploited in the wild.
How severe is CVE-2026-107472?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Qt 5 4.0.0 to 6.8.8; 6.9.0 to 6.11.2; Qt 6 6.8.0 to 6.8.8; 6.9.0 to 6.11.2.
Is there a fix for CVE-2026-107472?: Yes: fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107472 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-107472?: Check whether you run Qt 5 or Qt 6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Qt 6.8.9, Qt 6.11.3, Qt 6.12.0

Technical details

An out-of-bounds read in QTextCodec's TSCII encoding implementation allows reading memory outside the input buffer during text encoding operations. The vulnerability affects Qt's text codec layer across multiple versions; exploitation requires that an application use QTextCodec to convert text to TSCII encoding, triggering the out-of-bounds access.

Affected products

Qt Qt 5 4.0.0 to 6.8.8; 6.9.0 to 6.11.2
Qt Qt 6 6.8.0 to 6.8.8; 6.9.0 to 6.11.2

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.