Qt Core CVE-2026-105924

Exploitation requires a Qt application that invokes the Qt Core QCborValue-to-JSON conversion on attacker-influenced CBOR input; the passive user interaction (UI:P) means a victim must process the crafted data through such an application rather than the attacker triggering it directly. Limiting factors: the CVSS vector is local (AV:L), impact is confined to availability (application crash, no confidentiality or integrity effect), and the application must actually route untrusted CBOR data through this specific conversion path - applications that never parse external CBOR or never call this conversion are not exposed. Note the local vector may understate exposure where the CBOR data originates from a network source before being converted.

This is a genuinely low-to-moderate priority issue despite the CVE label. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 4.3 and limits impact to availability only (VC:N/VI:N/VA:H) - a crash, not code execution or data exposure, consistent with the CWE-476 NULL pointer dereference and the 'Denial Of Service' tag. Key decision signals point away from urgency: no CISA KEV listing, no EPSS probability supplied in the input, and no public exploit identified at time of analysis. The input's SSVC-style exploitation maturity is E:U (unreported/unproven). The vendor's own priority label is 'this_month', which aligns with a patch-on-normal-cadence posture rather than emergency. One tension worth noting: the vector is local (AV:L) with passive user interaction (UI:P), yet the flaw lives in a data-parsing path (CBOR→JSON) that in practice often handles externally-sourced data - so the real-world trigger surface may be broader than 'local' implies if an application feeds network-received CBOR into this conversion; verify against how the specific deployment sources its CBOR input. Overall: a real but contained availability bug, not a widespread-exploitation emergency.

An attacker crafts a malformed CBOR document and gets a Qt-based application to convert it to JSON via the vulnerable QCborValue path (for example, by supplying the data to an application feature that parses it). The conversion dereferences a NULL pointer and crashes the application, causing denial of service. No public exploit has been identified at time of analysis, and the low complexity means a reliable crash is plausible once the triggering input is known.