Live › vulnerability › CVE-2026-105924
Qt Core's conversion of QCborValue data to JSON dereferences a NULL pointer. An attacker who can supply crafted CBOR input that gets converted can crash the application that runs it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications built on Qt Core that convert CBOR data to JSON, especially those that accept CBOR from untrusted sources. Applications that never do this conversion, or only handle trusted data, are less exposed. The sources do not state affected version ranges.
No product ranges from the sources yet.
qmake --version or the Qt SDK's version file; the affected version range is unknown.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
This page as .md · .json · in your agent: get_signal("CVE-2026-105924")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.