Is CVE-2026-107590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107590 being exploited in the wild.

How severe is CVE-2026-107590?

Informational severity, published 27 October 2026.

Which products and versions are affected?

Qt 5 4.5.0 to 6.8.8, 6.9.0 to 6.11.2; Qt 5 Compatibility APIs included in Qt 5 and 6.

Is there a fix for CVE-2026-107590?

Yes: fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107590 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107590?

Check whether you run Qt 5 or Qt 5 Compatibility APIs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107590: Qt out-of-bounds write in QTextCodec iconv encoding

CVE-2026-107590 · Severity: info · Published 2026-10-27

Qt is a cross-platform application framework used in countless desktop and embedded applications. An out-of-bounds write vulnerability in the QTextCodec text encoding component can cause applications to crash or corrupt data when processing certain encoded text. Attackers who can control text input to an application using Qt could trigger this to disrupt service or modify stored information.

Technologies: Qt 5. Vendors: Qt.

Quick answers

Is CVE-2026-107590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107590 being exploited in the wild.
How severe is CVE-2026-107590?: Informational severity, published 27 October 2026.
Which products and versions are affected?: Qt 5 4.5.0 to 6.8.8, 6.9.0 to 6.11.2; Qt 5 Compatibility APIs included in Qt 5 and 6.
Is there a fix for CVE-2026-107590?: Yes: fixed in Qt 6.8.9, Qt 6.11.3, Qt 6.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107590 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107590?: Check whether you run Qt 5 or Qt 5 Compatibility APIs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Qt 6.8.9, Qt 6.11.3, Qt 6.12.0

Technical details

An out-of-bounds write flaw exists in QTextCodec's iconv-based encoding path in Qt Core (Qt 5 Compatibility APIs module and Qt 5 itself). Under specific conditions when encoding text, the code writes outside the bounds of an internal buffer, leading to buffer overflow. The vulnerability is reachable when an application uses QTextCodec to encode text, requires no authentication, and affects both Qt 5 and Qt 6 versions across a wide range of releases.

Affected products

Qt Qt 5 4.5.0 to 6.8.8, 6.9.0 to 6.11.2
Qt Qt 5 Compatibility APIs included in Qt 5 and 6

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.