CVE-2026-105924
NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
CVE-2026-105924- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2026-113895
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
EUVD-2026-113895- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcm5-mmcf-jwvm
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core...
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
GHSA-xcm5-mmcf-jwvm- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
CVE-2026-105924- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-105924
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
DEBIAN-CVE-2026-105924- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green - Updated
- 2026-11-02
OSVOESA-2026-4721
qt6-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
- Record
OESA-2026-4721- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-04
Show 4 moreShow less
OSVOESA-2026-4723
qt6-qtbase security update
Qt is a software toolkit for developing applications.
Security Fix(es):
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.(CVE-2026-105924)
Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (application crash) via a crafted NTLM challenge sent by a malicious server or proxy, when an application using QNetworkAccessManager or QTcpSocket authenticates with NTLM.(CVE-2026-105946)
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.(CVE-2026-107157)
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.(CVE-2026-19248)
Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server to an application using QNetworkAccessManager. Only the client side of the connection is affected and 32-bit builds are not affected; the out-of-bounds access is read-only, with no information disclosure and no code execution.(CVE-2026-76151)
- Record
OESA-2026-4723- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-105924
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
UBUNTU-CVE-2026-105924- CVSS 4.0
- 4.3 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green - Updated
- 2026-11-05
OSVAZL-112685 No score
CVE-2026-105924 affecting package qtbase 6.6.3-7
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
- Record
AZL-112685- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12384-1 No score
libQt6Concurrent6-6.12.0-2.1 on GA media
These are all security issues fixed in the libQt6Concurrent6-6.12.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12384-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qtbaseAzure Linux:3 |
through 6.6.3-7 | None known |
qt6-baseDebian:12 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 45 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-3 |
None known |
qt6-baseDebian:13 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 35 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
None known |
qt6-baseDebian:14 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 33 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
None known |
qtbase-opensource-srcDebian:12 |
All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 45 moreShow less5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-65.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-2 |
None known |
qtbase-opensource-srcDebian:13 |
All versions, plus listed versions 5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1 Show 15 moreShow less5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 |
None known |
qtbase-opensource-srcDebian:14 |
All versions, plus listed versions 5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2 Show 14 moreShow less5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 |
None known |
qt6-qtbaseopenEuler:24.03-LTS-SP3 From an advisory covering 5 CVEs |
before 6.5.2-18.oe2403sp3 | 6.5.2-18.oe2403sp3 |
qt6-qtbaseopenEuler:24.03-LTS-SP1 From an advisory covering 5 CVEs |
before 6.5.2-18.oe2403sp1 | 6.5.2-18.oe2403sp1 |
qtbase-opensource-srcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 15 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2 |
None known |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtbase-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 12 moreShow less5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2 |
None known |
qtbase-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 6 moreShow less5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4 |
None known |
qt6-baseUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1 |
None known |
qtbase-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3 Show 8 moreShow less5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3 |
None known |
qt6-baseUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5 |
None known |
qtbase-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1 Show 4 moreShow less5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1 |
None known |
qt6-baseUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2 |
None known |
qtbase-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2 |
None known |
qt6-baseUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7 |
None known |
qtbase-opensource-srcUbuntu:26.04:LTS |
All versions, plus listed versions 5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1 |
None known |
qt6-baseopenSUSE:Tumbleweed |
before 6.12.0-2.1 | 6.12.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105924 is a medium vulnerability (CVSS 4.3) in Qt, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in qt6-base 6.12.0-2.1.
References
wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products
codereview.qt-project.org/c/qt/qtbase/+/766809
nvd.nist.gov/vuln/detail/CVE-2026-105924
github.com/advisories/GHSA-xcm5-mmcf-jwvm
security-tracker.debian.org/tracker/CVE-2026-105924
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4721
Show 8 moreShow less
ubuntu.com/security/CVE-2026-105924
cve.org/CVERecord?id=CVE-2026-105924
suse.com/security/cve/CVE-2026-105924
Left out here: 44 versions. The JSON record has them.