CVE-2026-105924

MediumCVSS 4.3/10Last modified Oct 30, 2026

Description

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.

Metrics

CVSS 4.0 4.3/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
qtQt>= 5.12.0, <= 6.8.9; >= 6.9.0, <= 6.11.2; >= 6.12.0, < 6.12.1

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1059265.3The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCrCVE-2026-1059272.3The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer eCVE-2026-105936.5The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_eCVE-2026-1059306.0When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar PacCVE-2026-1059312.3The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization aCVE-2026-1059322.3The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persiCVE-2026-1059332.3Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_requiCVE-2026-1059347.2The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespaceCVE-2026-1059354.9The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the fuCVE-2026-1059365.3The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions workeCVE-2026-1059378.7Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The sourcCVE-2026-1059382.3Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which req
CVE-2026-105924: Medium severity, CVSS 4.3 | Vulnix