UBUNTU-CVE-2026-105924: Null Pointer Dereference
Published Nov 3, 2026
·Updated
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
Affected Software
11 affected components
ubuntu/qtbase-opensource-src*
ubuntu/qtbase-opensource-src*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
ubuntu/qt6-base*
ubuntu/qtbase-opensource-src*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Ubuntu packages are in scope?
The affected software listed is ubuntu/qtbase-opensource-src and ubuntu/qt6-base.
2
What access would an attacker need?
The CVSS vector indicates local access is required, no privileges are required, and user interaction is required.
3
What is the expected security impact?
The CVSS vector indicates high availability impact, with no confidentiality or integrity impact recorded.