{"id":"CVE-2026-105924","kind":"vulnerability","aliases":["CVE-2026-105924"],"related":[],"title":"Qt Core: QCborValue-to-JSON conversion can crash via a NULL pointer dereference","description":"A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.","summary":"Qt Core's conversion of QCborValue data to JSON dereferences a NULL pointer. An attacker who can supply crafted CBOR input that gets converted can crash the application that runs it.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","desktop-apps","package","qt"],"not_affected_if":["no-cbor-to-json-conversion","trusted-input-only"],"how_to_check":"- Check whether an application links against the Qt Core module and calls QCborValue-to-JSON conversion on untrusted input.\n- Check the installed Qt version with `qmake --version` or the Qt SDK's version file; the affected version range is unknown.","fix":null,"status":"open","published_at":"2026-10-30T12:16:34+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","triaged_at":"2026-10-30T12:34:03+00:00","updated_at":"2026-10-30T12:34:03+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T12:34:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Qt Core: QCborValue-to-JSON conversion can crash via a NULL pointer dereference","impact":"low","summary":"Qt Core's conversion of QCborValue data to JSON dereferences a NULL pointer. An attacker who can supply crafted CBOR input that gets converted can crash the application that runs it.","audience":"developers","category":"package","nicknames":[],"who_cares":["qt","c++","desktop-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Application crashes from a NULL pointer dereference during conversion","analyst_note":"Find the affected and fixed Qt versions and the trigger conditions at https://nvd.nist.gov/vuln/detail/CVE-2026-105924 and the Qt project advisory.","how_to_check":"- Check whether an application links against the Qt Core module and calls QCborValue-to-JSON conversion on untrusted input.\n- Check the installed Qt version with `qmake --version` or the Qt SDK's version file; the affected version range is unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["no-cbor-to-json-conversion","trusted-input-only"],"who_is_affected":"Applications built on Qt Core that convert CBOR data to JSON, especially those that accept CBOR from untrusted sources. Applications that never do this conversion, or only handle trusted data, are less exposed. The sources do not state affected version ranges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4069,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105924':17A,20A '-2026':16A,19A 'app':24B 'applic':54B 'attack':41B 'c':21B 'cbor':46B 'convers':7A,30B,68C 'convert':50B 'core':2A,28B,72C 'craft':45B 'crash':9A,52B 'cve':15A,18A 'data':33B 'derefer':14A,36B,60C 'desktop':23B 'desktop-app':22B 'get':49B 'input':47B 'json':6A,35B,67C 'modul':73C 'null':12A,38B,58C 'packag':25B 'pointer':13A,39B,59C 'qcborvalu':4A,32B,65C 'qcborvalue-to-json':3A 'qt':1A,26B,27B,64C,71C 'run':56B 'suppli':44B 'via':10A 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Qt Core that convert CBOR data to JSON, especially those that accept CBOR from untrusted sources. Applications that never do this conversion, or only handle trusted data, are less exposed. The sources do not state affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","cvss_by":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105924","severity":null,"published_at":"2026-10-30T12:16:34+00:00","modified_at":"2026-10-30T12:16:34+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","fetched_at":"2026-10-30T12:30:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}