CVE-2026-105924

A flaw was found in Qt. This vulnerability allows an attacker to trigger a Denial of Service (DoS) by providing specially crafted Concise Binary Object Representation (CBOR) data. When the application converts this input into JavaScript Object Notation (JSON) format using QCborValue, a NULL pointer dereference occurs, leading to an application crash.

A NULL pointer dereference vulnerability in the Qt Core module during QCborValue to JSON conversion allows an attacker to cause an application crash and denial of service by supplying specially crafted CBOR input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Validate and sanitize untrusted CBOR input before passing it to QCborValue JSON conversion routines, or avoid converting untrusted CBOR data to JSON format.