CVE-2026-105924 in Qt
Summary
by MITRE • 10/30/2026
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability resides within the Qt Core module, specifically affecting the serialization logic responsible for converting QCBorValue objects into JSON format. This flaw manifests as a null pointer dereception, which occurs when the application attempts to access memory at an address that has not been allocated or is otherwise invalid due to being zero. In the context of CBOR (Concise Binary Object Representation) processing, this typically happens during the parsing phase where specific data structures are mapped to their JSON equivalents. If a particular field within the CBOR structure is expected to contain a value but instead holds null or an empty reference that was not properly validated before conversion, the underlying C++ code attempts to dereference this invalid pointer. This results in immediate memory access violation, causing the application process to terminate abruptly with a segmentation fault.
From a technical perspective, this issue represents a classic failure of input validation and boundary checking within the serialization pipeline. The vulnerability allows an attacker who can supply crafted CBOR data to trigger a denial-of-service condition against any service or client that processes such payloads using the affected Qt version. While null pointer dereferences are often categorized as reliability issues rather than direct code execution vectors, they remain significant security risks in network-facing applications. If the vulnerable component is part of an API server or a web application backend handling untrusted input, the ability to crash the service disrupts availability for legitimate users. Furthermore, depending on the specific compiler optimizations and runtime environment, such memory corruption could potentially be leveraged as part of a larger attack chain, although the primary impact remains the disruption of service through process termination.
This vulnerability aligns with Common Weakness Enumeration CWE-476, which defines NULL Pointer Dereference, indicating that the software performs an operation on a pointer without verifying that it is non-null first. In terms of offensive security frameworks, this behavior corresponds to techniques found in MITRE ATT&CK under Denial of Service (T1499), specifically where attackers exploit application logic flaws or resource exhaustion conditions to degrade service availability. The lack of robust error handling for malformed CBOR inputs highlights a gap in the defensive coding practices applied during the development of the JSON conversion routine, emphasizing the need for stricter type checking and null checks before any pointer arithmetic or member access is performed on deserialized objects.
To mitigate this vulnerability, developers should update to a patched version of Qt Core that includes fixes for these serialization edge cases. In environments where immediate patching is not feasible, implementing input validation at the network boundary can help filter out malformed CBOR payloads before they reach the vulnerable conversion logic. This involves validating the structure and content of incoming data against expected schemas or using strict parsing modes that reject ambiguous or incomplete structures rather than attempting to coerce them into JSON format. Additionally, enabling runtime protections such as Address Sanitizer during testing phases can help identify similar null dereference issues in other parts of the codebase before they reach production systems.