EUVD-2026-113895
GHSA-xcm5-mmcf-jwvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted CBOR data to Qt application
-
ExploitTrigger NULL pointer dereference in QCborValue-to-JSON conversion
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Qt application that invokes the Qt Core QCborValue-to-JSON conversion on attacker-influenced CBOR input; the passive user interaction (UI:P) means a victim must process the crafted data through such an application rather than the attacker triggering it directly. Limiting factors: the CVSS vector is local (AV:L), impact is confined to availability (application crash, no confidentiality or integrity effect), and the application must actually route untrusted CBOR data through this specific conversion path - applications that never parse external CBOR or never call this conversion are not exposed. Note the local vector may understate exposure where the CBOR data originates from a network source before being converted. |
| Impact | This is a genuinely low-to-moderate priority issue despite the CVE label. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 4.3 and limits impact to availability only (VC:N/VI:N/VA:H) - a crash, not code execution or data exposure, consistent with the CWE-476 NULL pointer dereference and the 'Denial Of Service' tag. Key decision signals point away from urgency: no CISA KEV listing, no EPSS probability supplied in the input, and no public exploit identified at time of analysis. The input's SSVC-style exploitation maturity is E:U (unreported/unproven). The vendor's own priority label is 'this_month', which aligns with a patch-on-normal-cadence posture rather than emergency. One tension worth noting: the vector is local (AV:L) with passive user interaction (UI:P), yet the flaw lives in a data-parsing path (CBOR→JSON) that in practice often handles externally-sourced data - so the real-world trigger surface may be broader than 'local' implies if an application feeds network-received CBOR into this conversion; verify against how the specific deployment sources its CBOR input. Overall: a real but contained availability bug, not a widespread-exploitation emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed CBOR document and gets a Qt-based application to convert it to JSON via the vulnerable QCborValue path (for example, by supplying the data to an application feature that parses it). The conversion dereferences a NULL pointer and crashes the application, causing denial of service. No public exploit has been identified at time of analysis, and the low complexity means a reliable crash is plausible once the triggering input is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
NULL pointer dereference in the Qt Core QCborValue-to-JSON conversion crashes applications that route attacker-influenced CBOR input through that specific conversion path, giving a local attacker who can supply crafted data a denial-of-service effect (application termination, no confidentiality or integrity impact). It is rated CVSS 4.0 4.3 locally and an assessed CVSS 3.1 5.5 locally, reflecting that the victim must process the crafted CBOR via a vulnerable Qt application rather than the attacker triggering it directly. The vulnerability is not listed as confirmed actively exploited (CISA KEV) and no public exploit was identified at time of analysis; the vendor has published a fix in the qtbase code review.
RemediationAI
Apply the vendor fix: a patch is available from the vendor and the upstream change is https://codereview.qt-project.org/c/qt/qtbase/+/766809, referenced from the Qt advisory at https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105924; the sources do not state an exact released Qt version containing the fix, so confirm the patched Qt minor release against the advisory before upgrading and rebuild applications against the corrected qtbase. The independent assessment classifies this as a low-to-moderate, this-month priority rather than an emergency, so schedule the Qt upgrade in the normal monthly maintenance cycle. Where an immediate upgrade is not possible, reduce exposure by keeping untrusted or external CBOR away from the QCborValue-to-JSON conversion path: reject or defer CBOR from untrusted sources before conversion, or perform the conversion in a separate, restartable process, accepting that this is a containment measure that depends on every conversion call site being identified and that it does not fix the underlying defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Qt Core provides QCborValue, the in-memory representation of CBOR (RFC 8949) data, along with facilities for converting CBOR documents into JSON (QCborValue::toJsonValue / QCborValue::toJsonDocument and the underlying conversion code in qtbase). The flaw is a CWE-476 NULL pointer dereference reached during that QCborValue-to-JSON conversion; the supplied sources do not describe the precise input shape or code path that triggers it, so the exact malformed-CBOR structure is not established from available data. The CPE cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* indicates the affected component is published under the generic Qt product without a version-range restriction in the provided feed data. Exposure therefore depends on whether an application actually parses external CBOR and invokes this conversion on it - applications that never handle untrusted CBOR or never call the conversion are outside the vulnerable path.
Know when Qt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/R:U/RE:L/U:Green
Local data-conversion path (AV:L) needing a victim to process crafted input (UI:R), no privileges, crash-only so C:N/I:N and A:H, scope unchanged.
Primary rating from Vendor (Qt).
CVSS VectorVendor: Qt
DescriptionCVE.org
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. Rated critical sever
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlS
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error qu
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potential
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, an
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Rated cr
An issue was discovered in Qt before 5.11.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (applic
Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 charac
An issue was discovered in Qt before 5.11.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML doc
Exploit-DB