Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-105924medium4.3

NULL pointer dereference vulnerability in QCborValue to JSON conversion impacts Qt

Impact

Qt Core module has a NULL pointer dereference vulnerability in QCborValue to JSON conversion, affecting versions 5.12.0 to 6.8.9, 6.9.0 to 6.11.2, and 6.12.0 to less than 6.12.1. The weakness is a NULL pointer dereference. The impact is not specified.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

qt · Qt

Qt

4 ranges
Qt version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.12.0 → through 6.8.9

python versions

6.9.0 → through 6.11.2

python versions

6.12.0 → before 6.12.1

python versions

unaffected

0 → before 5.12.0

python versions

unknown

Other versions: unaffected

Product identifiers (CPE)cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*

Original source description

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-105924

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-476 ↗

CWE-476 NULL Pointer Dereference

Qt

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Qt · platform conditions

Any condition may hold

Any condition may hold

Vulnerable product

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*

From (inclusive): 5.12.0

Through (inclusive): 6.8.9

Vulnerable product

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*

From (inclusive): 6.9.0

Through (inclusive): 6.11.2

Vulnerable product

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*

From (inclusive): 6.12.0

Before: 6.12.1

Required environment

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*

From (inclusive): 0

Before: 5.12.0

Original applicability statements
[
  {
    "operator": "OR",
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.12.0",
            "versionEndIncluding": "6.8.9"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.9.0",
            "versionEndIncluding": "6.11.2"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.12.0",
            "versionEndExcluding": "6.12.1"
          },
          {
            "vulnerable": false,
            "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "0",
            "versionEndExcluding": "5.12.0"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 2
Qt

Assigning organization

2026-10-30
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
  1. CVE · CVE-2026-105924

    Observed 2026-10-30T15:43:09.274Z · upstream updated 2026-10-30T15:25:08.893Z

    Prioritization updated

    before

    []

    after

    [
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T15:24:54.286064Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

2 sources
wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products
vendor-advisoryQt
codereview.qt-project.org/c/qt/qtbase/+/766809
patchQt