NULL pointer dereference in Qt QCborValue to JSON conversion
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
The Qt Core module of Qt, from 5.12.0 through 6.8.9, from 6.9.0 through 6.11.2 and from 6.12.0 before 6.12.1, has a NULL pointer dereference (CWE-476) in the QCborValue to JSON conversion. A local attacker with no privileges can crash the application, but a user must interact with it for the attack to work.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Qt 6.12.1 fixes the flaw, so update Qt to 6.12.1. Red Hat fixes Red Hat Hardened Images in RHSA-2026:94798 and RHSA-2026:94640. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Qt (qt) Fixed in 6.12.1
Red Hat 2 advisories
- RHSA-2026:94798 Released 2026-11-03 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images qt6-qtbase-6.12.0-1.1.hum1@aarch64, qt6-qtbase-6.12.0-1.1.hum1@s390x, qt6-qtbase-6.12.0-1.1.hum1@src +31
- RHSA-2026:94640 Released 2026-11-03 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images qt5-qtbase-5.15.18-6.2.hum1@aarch64, qt5-qtbase-5.15.18-6.2.hum1@s390x, qt5-qtbase-5.15.18-6.2.hum1@src +34
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat Hardened Images | Fixed | RHSA-2026:94640, RHSA-2026:94798 |
Timeline
- 2026-10-30 Threatist record created from CVE-2026-105924
- 2026-10-30 Alias added: GHSA-xcm5-mmcf-jwvm
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-31 Affected versions changed · Red Hat
- 2026-10-31 CVSS score added · Red Hat
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94798 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94640 · Red Hat
- 2026-11-04 Fix available: Red Hat Hardened Images · Red Hat
References
More qt vulnerabilities
- TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
- TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
- TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
- TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
- TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
- TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-105924 · CVE Program
- CVE-2026-105924 · NVD
- FIRST EPSS
- GHSA-xcm5-mmcf-jwvm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-105924 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences