Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by Qt

CVE-2026-105924NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt

Medium 4.3

In plain English

A medium-severity null pointer dereference in Qt from qt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)4.3Medium
Exploit odds (30 days)0.2%top 94.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12qt6-baseno fix listedDEBIAN-CVE-2026-105924
Debian:13qt6-baseno fix listedDEBIAN-CVE-2026-105924
Debian:14qt6-baseno fix listedDEBIAN-CVE-2026-105924
Debian:12qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105924
Debian:13qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105924
Debian:14qtbase-opensource-srcno fix listedDEBIAN-CVE-2026-105924
Ubuntu:22.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-105924
Ubuntu:24.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-105924
Ubuntu:26.04:LTSqt6-baseno fix listedUBUNTU-CVE-2026-105924
Ubuntu:26.10qt6-baseno fix listedUBUNTU-CVE-2026-105924
Ubuntu:26.04:LTSqtbase-opensource-srcno fix listedUBUNTU-CVE-2026-105924
Ubuntu:26.10qtbase-opensource-srcno fix listedUBUNTU-CVE-2026-105924

Affected products (as reported)

VendorProductVersions
qt Qt 5.12.0 – through 6.8.96.9.0 – through 6.11.26.12.0 – before 6.12.1

Weakness: CWE-476 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green

References