Qt Releases Patch for NULL Pointer Dereference in Core CBOR Conversion
Qt has issued security updates to fix a NULL pointer dereference in versions 5.12.0 through 6.12.0 that could lead to denial of service via crafted CBOR data.
Qt disclosed CVE-2026-105924, a NULL pointer dereference in Qt Core affecting the conversion of QCborValue data to JSON. Applications decoding untrusted CBOR and converting it to QJsonValue, QJsonArray, or QJsonObject can be crashed via specially crafted input, causing a denial of service. Depending on compiler and optimizer behavior, other memory-safety consequences are also possible.
Published on October 30, 2026, the advisory lists no mitigation other than patching or upgrading, and scores the issue 4.3 (Medium) under CVSS 4.0 with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green.
The vulnerability impacts Qt versions 5.12.0 through 6.8.9, 6.9.0 through 6.11.2, and 6.12.0. The solution is to update to Qt 6.8.10, Qt 6.11.3, Qt 6.12.1, or later.
If you cannot upgrade immediately, patches are available for specific branches:
- Dev branch: change 766809 in qtbase on the Qt code review system.
- Qt 6.12: change 777125 and a downloadable diff on download.qt.io.
- Qt 6.11: change 778089 and a matching diff.
- Qt 6.8: change 777333 in tqtc-qtbase, plus a diff in the archive area of download.qt.io.
No patches are listed for Qt 5.x, 6.9, or 6.10, so you must check with Qt for guidance if you use those versions. Additionally, CVE-2026-105946 was published alongside this notice for an out-of-bounds read in NTLM authentication handling.