An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5) has been discovered and has been assigned the CVE id CVE-2026-103645. Only builds where Qt is compiled with ICU support are affected.
Affected versions: from Qt 5.0.0 to Qt 6.8.8, from Qt 6.9.0 to Qt 6.11.2
Affected status unknown before Qt 5.0.0
Impact: Availability. Processing very large amounts of input data may cause the application to enter an infinite loop and stop responding (denial of service).
CVSS 4.0 Score: 1.1 / Low
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:U/U:Clear
Mitigation: Perform the conversion in chunks of at most 100 MB, using the overload QTextCodec::fromUnicode(const QChar *input, int number, QTextCodec::ConverterState *state = nullptr).
Solution: Apply the following patch or update to Qt 6.8.9, Qt 6.11.3, Qt 6.12.0 or later.
Patches:
dev: https://codereview.qt-project.org/c/qt/qt5compat/+/762795
Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/766197 or https://download.qt.io/archive/qt/6.11/CVE-2026-103645-qt5compat-6.11.diff
Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/766291 or https://download.qt.io/archive/qt/6.8/CVE-2026-103645-qt5compat-6.8.diff
