Qt 6.8.10, 6.11.3, and 6.12.1 Fix CBOR Conversion Flaw
Tech GuruQuick Answer
Qt CVE-2026-105924 affects QCborValue-to-JSON conversion for crafted CBOR. Inventory Qt applications and embedded copies, update to 6.8.10, 6.11.3, or 6.12.1 as applicable, rebuild and redistribute affected software, validate parser behavior, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory applications and devices embedding Qt, exact framework branches, static or bundled copies, CBOR input paths, package owners, build pipelines, and support status. Confirm that an affected Qt build and QCborValue JSON conversion path are present; do not infer exposure from the application name or Qt use alone. Update the supported branch to Qt 6.8.10, 6.11.3, or 6.12.1, rebuild statically linked applications, and obtain vendor guidance for older branches. Confirm bundled library versions, exercise representative and malformed CBOR inputs safely, test dependent applications, track redistributed builds, and retain SBOM and pipeline evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Qt Framework QCborValue JSON conversion |
|---|---|
| Advisory | CVE-2026-105924 |
| CVE | CVE-2026-105924 |
| Authoritative release date | 2026-10-30 11:42:35 UTC |
| Authority revision date | 2026-10-30 11:42:35 UTC |
| Affected versions | Qt 5.12.0 through 6.8.9, Qt 6.9.0 through 6.11.2, and Qt 6.12.0 when processing crafted CBOR through the affected conversion path. |
| Fixed version | Qt 6.8.10, Qt 6.11.3, or Qt 6.12.1; organizations on older or unsupported branches should obtain vendor guidance |
| CVSS base score | 4.3 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | Qt does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Qt fixed a crafted-CBOR conversion issue that can crash applications and may create memory-safety consequences when QCborValue is converted to JSON.
What To Validate Now
- Inventory. Inventory applications and devices embedding Qt, exact framework branches, static or bundled copies, CBOR input paths, package owners, build pipelines, and support status.
- Establish applicability. Confirm that an affected Qt build and QCborValue JSON conversion path are present; do not infer exposure from the application name or Qt use alone.
- Remediate. Update the supported branch to Qt 6.8.10, 6.11.3, or 6.12.1, rebuild statically linked applications, and obtain vendor guidance for older branches.
- Validate. Confirm bundled library versions, exercise representative and malformed CBOR inputs safely, test dependent applications, track redistributed builds, and retain SBOM and pipeline evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Static linking and vendor-forked Qt can hide vulnerable copies. A crash is not by itself proof of code execution; use the authority's stated impact and exact product scope.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
