Back Linuxsecurity

Oracle Linux 9 qt5-qtbase Vital Out-of-Bounds Read Patch ELSA-2026-65993

Linuxsecurity •LinuxSecurity Advisories • September 10, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

[5.15.9-11.1] - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName() Resolves: RHEL-247216

qt5-qtbase-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-common-5.15.9-11.el9_8.1.noarch.rpm qt5-qtbase-devel-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-devel-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-examples-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-examples-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-gui-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-gui-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-mysql-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-mysql-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-odbc-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-odbc-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-postgresql-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-postgresql-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-private-devel-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-private-devel-5.15.9-11.el9_8.1.x86_64.rpm qt5-qtbase-static-5.15.9-11.el9_8.1.i686.rpm qt5-qtbase-static-5.15.9-11.el9_8.1.x86_64.rpm

qt5-qtbase-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-common-5.15.9-11.el9_8.1.noarch.rpm qt5-qtbase-devel-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-examples-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-gui-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-mysql-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-odbc-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-postgresql-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-private-devel-5.15.9-11.el9_8.1.aarch64.rpm qt5-qtbase-static-5.15.9-11.el9_8.1.aarch64.rpm

Related CVEs: CVE-2026-9499

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Out-of-Bounds Read Vulnerabilities in Oracle Linux 9 and 10 Oracle has released patches for significant out-of-bounds read vulnerabilities affecting Oracle Linux 9 and 10. Both vulnerabilities, identified as CVE-2026-9499, impact the QTextCodec::codecForName() function, potentially allowing attackers to read sensitive memory locations. The vulnerabilities were disclosed on July 21, 2026, and affect multiple packages in both Linux distributions. The patches include updates for qt5-qtbase in Oracle Linux 9 and qt6-qt5compat in Oracle Linux 10. Users are urged to apply the updates to mitigate potential exploitation. The vulnerabilities are not currently reported as actively exploited in the wild, but the existence of proof-of-concept code raises concerns. Organizations using these versions should prioritize patching to secure their systems. 2 sources 45

Extracted Entities

Oracle Linux 9 qt5-qtbase Vital Out-of-Bounds Read Patch ELSA-2026-65993

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (2)