From announce at qt-project.org Fri Jul 10 16:16:34 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Fri, 10 Jul 2026 14:16:34 +0000 Subject: [Announce] Qt 6.8.4 Opensource released Message-ID: Hi all, we have released Qt 6.8.4 opensource: * release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/6.8.4/release-note.md * source packages in download.qt.io: * https://download.qt.io/official_releases/qt/6.8/6.8.4/ * https://download.qt.io/official_releases/QtForPython/pyside6/PySide6-6.8.4-src/ * Git: clone the release with the tag v6.8.4-lts-lgpl Best regards Tarja Sundqvist Release manager Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: From announce at qt-project.org Tue Jul 14 18:05:36 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Tue, 14 Jul 2026 16:05:36 +0000 Subject: [Announce] Qt 6.12 Beta 2 Released Message-ID: Hi all, We have released Qt 6.12.0 Beta 2 today. As earlier, you can get it via Qt online installer. The source packages are also available in Qt Account and download.qt.io: https://download.qt.io/development_releases/qt/6.12/6.12.0-beta2/ Please see the attached delta to the Qt 6.12 Beta 1. Please make sure you will report all findings in Jira. Best regards, Tarja Sundqvist Release manager Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: delta_qt6.12.0-beta1_qt6.12.0-beta2.txt URL: From announce at qt-project.org Tue Jul 21 14:44:35 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Tue, 21 Jul 2026 12:44:35 +0000 Subject: [Announce] Security advisory: Out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt Message-ID: An out-of-bounds read (buffer over-read) vulnerability in the QTextCodec::codecForName() function of the Qt 5 Core Compatibility APIs (the Qt5Compat module) has been discovered and has been assigned the CVE id CVE-2026-9499 Affected versions: from Qt 4.0.0 to 6.8.7, and from Qt 6.9.0 to 6.11.0. This defect has existed since the introduction of the Qt5Compat module (Qt 6.0.0); the equivalent code path also exists from Qt 4.0.0 to Qt 5.15.19 LTS (Qt Core / qtbase). Impact: Passing a non-NUL-terminated QByteArray (for example, one created with QByteArray::fromRawData()) to QTextCodec::codecForName() can cause the codec-name matching routine to read past the end of the buffer, resulting in an incorrect codec match or, in the worst case, an application crash (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the bytes read are only compared against Qt's fixed internal codec list ? no application or user data is exposed to an attacker. CVSS 4.0 Score: 6.3 (MEDIUM) Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Mitigation: No practical runtime workaround is available short of applying the patch or upgrading. If your application does not construct codec-name QByteArrays via QByteArray::fromRawData(), you are not exposed to this issue. Solution: Apply the following patch, or update to Qt 6.8.8, Qt 6.11.1, or later. Patches: dev: https://codereview.qt-project.org/c/qt/qt5compat/+/723911 Qt 6.11: https://codereview.qt-project.org/c/qt/qt5compat/+/724348 or https://download.qt.io/official_releases/qt/6.11/CVE-2026-9499-qt5compat-6.11.diff Qt 6.10: https://codereview.qt-project.org/c/qt/qt5compat/+/724995 or https://download.qt.io/official_releases/qt/6.10/CVE-2026-9499-qt5compat-6.10.diff Qt 6.8: https://codereview.qt-project.org/c/qt/tqtc-qt5compat/+/725112 or https://download.qt.io/official_releases/qt/6.8/CVE-2026-9499-qt5compat-6.8.diff Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: From announce at qt-project.org Thu Jul 23 14:55:04 2026 From: announce at qt-project.org (List for announcements regarding Qt releases and development) Date: Thu, 23 Jul 2026 12:55:04 +0000 Subject: [Announce] Security advisory: CVE-2026-15037 - XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization Message-ID: An XML injection (improper output neutralization) vulnerability in the Qt XMLQDom comment, CDATA section, and processing-instruction serialization of the Qt Framework (QtXml module) has been discovered and has been assigned the CVE id CVE-2026-15037. Affected versions: all Qt 4 and Qt 5 and Qt 6 releases before Qt 6.12 (default QDomImplementation::InvalidDataPolicy of AcceptInvalidChars). Impact: An application that inserts untrusted text into a QDom comment, CDATA section, or processing-instruction node and then serializes the document may emit XML in which the untrusted text closes the intended node and injects attacker-controlled sibling markup, corrupting the structure of the produced document. There is no impact on confidentiality and no code execution or denial-of-service within Qt itself. CVSS 4.0 Score: 2.9 (LOW) Vector String:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P Mitigation: On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode); (or DropInvalidChars). With ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 ? check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream. Solution: Update to Qt 6.12 or later, where the default InvalidDataPolicy is ReturnNullNode. On Qt 6.11 and earlier the default is unchanged; apply the mitigation above. Patches: dev: https://codereview.qt-project.org/c/qt/qtbase/+/748323 Confidential -------------- next part -------------- An HTML attachment was scrubbed... URL: