Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt

An out-of-bounds read (buffer over-read) vulnerability in the QTextCodec::codecForName() function of the Qt 5 Core Compatibility APIs (the Qt5Compat module) has been discovered and has been assigned the CVE id CVE-2026-9499Affected versions: from Qt 4.0.0 to 6.8.7, and from Qt 6.9.0 to 6.11.0. This defect has existed since the introduction of the Qt5Compat module (Qt 6.0.0); the equivalent code path also exists from Qt 4.0.0 to Qt 5.15.19 LTS (Qt Core / qtbase). CVSS 4.0 Score: 6.3 (MEDIUM)Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NMitigation: No practical runtime workaround is available short of applying the patch or upgrading. If your application does not construct codec-name QByteArrays via QByteArray::fromRawData(), you are not exposed to this issue. Solution: Apply the following patches, or update to Qt 6.8.8, Qt 6.11.1, or later.