From announce at qt-project.org Fri Jul 10 16:16:34 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Fri, 10 Jul 2026 14:16:34 +0000 Subject: [Announce] Qt 6.8.4 Opensource released Message-ID: Hi all, we have released Qt 6.8.4 opensource: * release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/6.8.4/release-note.md * source packages in download.qt.io: * https://download.qt.io/official_releases/qt/6.8/6.8.4/ * https://download.qt.io/official_releases/QtForPython/pyside6/PySide6-6.8.4-src/ * Git: clone the release with the tag v6.8.4-lts-lgpl Best regards Tarja Sundqvist Release manager Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: From announce at qt-project.org Tue Jul 14 18:05:36 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Tue, 14 Jul 2026 16:05:36 +0000 Subject: [Announce] Qt 6.12 Beta 2 Released Message-ID: Hi all, We have released Qt 6.12.0 Beta 2 today. As earlier, you can get it via Qt online installer. The source packages are also available in Qt Account and download.qt.io: https://download.qt.io/development_releases/qt/6.12/6.12.0-beta2/ Please see the attached delta to the Qt 6.12 Beta 1. Please make sure you will report all findings in Jira. Best regards, Tarja Sundqvist Release manager Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: delta_qt6.12.0-beta1_qt6.12.0-beta2.txt URL: From announce at qt-project.org Tue Jul 21 14:44:35 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Tue, 21 Jul 2026 12:44:35 +0000 Subject: [Announce] Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt Message-ID: An out-of-bounds read (buffer over-read) vulnerability in the QTextCodec::codecForName() function of the Qt 5 Core Compatibility APIs (the Qt5Compat module) has been discovered and has been assigned the CVE id CVE-2026-9499 Affected versions: from Qt 4.0.0 to 6.8.7, and from Qt 6.9.0 to 6.11.0. This defect has existed since the introduction of the Qt5Compat module (Qt 6.0.0); the equivalent code path also exists from Qt 4.0.0 to Qt 5.15.19 LTS (Qt Core / qtbase). Impact: Passing a non-NUL-terminated QByteArray (for example, one created with QByteArray::fromRawData()) to QTextCodec::codecForName() can cause the codec-name matching routine to read past the end of the buffer, resulting in an incorrect codec match or, in the worst case, an application crash (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the bytes read are only compared against Qt's fixed internal codec list ? no application or user data is exposed to an attacker. CVSS 4.0 Score: 6.3 (MEDIUM) Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Mitigation: No practical runtime workaround is available short of applying the patch or upgrading. If your application does not construct codec-name QByteArrays via QByteArray::fromRawData(), you are not exposed to this issue. Solution: Apply the following patch, or update to Qt 6.8.8, Qt 6.11.1, or later. Patches: dev: https://codereview.qt-project.org/c/qt/qt5compat/+/723911 Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/724348 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-9499-qt5compat-6.11.diff Qt 6.10: https://codereview.qt-project.org/c/qt/qt5compat/+/724995 or https://download.qt.io/official_releases/qt/6.10/CVE-2026-9499-qt5compat-6.10.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112 or https://download.qt.io/official_releases/qt/6.8/CVE-2026-9499-qt5compat-6.8.diff Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: From announce at qt-project.org Thu Jul 23 14:55:04 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Thu, 23 Jul 2026 12:55:04 +0000 Subject: [Announce] Security advisory: CVE-2026-15037 - XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization Message-ID: An XML injection (improper output neutralization) vulnerability in the Qt XMLQDom comment, CDATA section, and processing-instruction serialization of the Qt Framework (QtXml module) has been discovered and has been assigned the CVE id CVE-2026-15037. Affected versions: all Qt 4 and Qt 5 and Qt 6 releases before Qt 6.12 (default QDomImplementation::InvalidDataPolicy of AcceptInvalidChars). Impact: An application that inserts untrusted text into a QDom comment, CDATA section, or processing-instruction node and then serializes the document may emit XML in which the untrusted text closes the intended node and injects attacker-controlled sibling markup, corrupting the structure of the produced document. There is no impact on confidentiality and no code execution or denial-of-service within Qt itself. CVSS 4.0 Score: 2.9 (LOW) Vector String:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P Mitigation: On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode); (or DropInvalidChars). With ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 ? check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream. Solution: Update to Qt 6.12 or later, where the default InvalidDataPolicy is ReturnNullNode. On Qt 6.11 and earlier the default is unchanged; apply the mitigation above. Patches: dev: https://codereview.qt-project.org/c/qt/qtbase/+/748323 Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: From announce at qt-project.org Thu Jul 30 11:33:40 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Thu, 30 Jul 2026 09:33:40 +0000 Subject: [Announce] Qt Creator 20.0.1 released Message-ID: We are happy to announce the release of Qt Creator 20.0.1! https://www.qt.io/blog/qt-creator-20.0.1-released ? Eike Ziller Principal Software Engineer The Qt Company GmbH Erich-Thilo-Str. 10 12489 Berlin, Germany eike.ziller at qt.io https://www.qt.io Gesch?ftsf?hrer: Mika P?lsi, Juha Varelius, Juha Puputti Sitz der Gesellschaft: Berlin, Registergericht: Amtsgericht Charlottenburg, HRB 144331 B From announce at qt-project.org Fri Jul 31 13:31:52 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Fri, 31 Jul 2026 11:31:52 +0000 Subject: [Announce] Update on "Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt" Message-ID: Reason for update: Provided patch did not apply directly for the latest released versions of the supported branches. Earlier announcement was missing a link to a patch which needs to be applied before the patch which fixes the vulnerability. Patches available at download.qt.io have been updated. Please find the updated announcement below. We apologize for the inconvenience. An out-of-bounds read (buffer over-read) vulnerability in the QTextCodec::codecForName() function of the Qt 5 Core Compatibility APIs (the Qt5Compat module) has been discovered and has been assigned the CVE id CVE-2026-9499 Affected versions: from Qt 4.0.0 to 6.8.7, and from Qt 6.9.0 to 6.11.0. This defect has existed since the introduction of the Qt5Compat module (Qt 6.0.0); the equivalent code path also exists from Qt 4.0.0 to Qt 5.15.19 LTS (Qt Core / qtbase). Impact: Passing a non-NUL-terminated QByteArray (for example, one created with QByteArray::fromRawData()) to QTextCodec::codecForName() can cause the codec-name matching routine to read past the end of the buffer, resulting in an incorrect codec match or, in the worst case, an application crash (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the bytes read are only compared against Qt's fixed internal codec list ? no application or user data is exposed to an attacker. CVSS 4.0 Score: 6.3 (MEDIUM) Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Mitigation: No practical runtime workaround is available short of applying the patch or upgrading. If your application does not construct codec-name QByteArrays via QByteArray::fromRawData(), you are not exposed to this issue. Solution: Apply the following patches, or update to Qt 6.8.8, Qt 6.11.1, or later. Patches: dev: https://codereview.qt-project.org/c/qt/qt5compat/+/723910 and https://codereview.qt-project.org/c/qt/qt5compat/+/723911 Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/724270 and https://codereview.qt-project.org/c/qt/qt5compat/+/724348 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-9499-qt5compat-6.11.diff Qt 6.10: https://codereview.qt-project.org/c/qt/qt5compat/+/724362 and https://codereview.qt-project.org/c/qt/qt5compat/+/724995 or https://download.qt.io/official_releases/qt/6.10/CVE-2026-9499-qt5compat-6.10.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725002 and https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112 or https://download.qt.io/official_releases/qt/6.8/CVE-2026-9499-qt5compat-6.8.diff Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: