Hi,

The following vulnerability was published for qt6-5compat.

CVE-2026-101201[0]:
| A malformed header in the binary file fed to
| QBinaryJson::fromBinaryData() can cause undefined behaviour because
| of out-of-bounds read.

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201

https://github.com/qt/qt5compat/commit/721ed576391211ca53ecdaaecf6dd41df7bc962e
https://github.com/qt/qt5compat/commit/c0a495894d83a3c48055bd1e544f93147fc6ade1


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-101201
https://www.cve.org/CVERecord?id=CVE-2026-101201

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
qt6-5compat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152312@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Patrick Franz <deltaone@debian.org> (supplier of updated qt6-5compat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 03 Nov 2026 00:01:24 +0100
Source: qt6-5compat
Architecture: source
Version: 6.11.2-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Patrick Franz <deltaone@debian.org>
Closes: 1152312
Changes:
 qt6-5compat (6.11.2-3) unstable; urgency=medium
 .
   [ Patrick Franz ]
   * Backport patches to fix CVE-2026-101201 (Closes: #1152312).
Checksums-Sha1:
 195f02f77ff664316672070f1b52c17d9190f1de 2907 qt6-5compat_6.11.2-3.dsc
 ba0c265ecf25875fedf6a6737ded37130317adbc 13660 qt6-5compat_6.11.2-3.debian.tar.xz
 2b5e9a2ef8e74d68a384f05eb2d26340de0a0d66 12028 qt6-5compat_6.11.2-3_source.buildinfo
Checksums-Sha256:
 8c0c386b1938f94c3b3d6c155bca61e263c02d43410f3880104a506fc1817e45 2907 qt6-5compat_6.11.2-3.dsc
 711686e07bbb4b76df83028ba7cb1473d6f1bc933a4b4081734d639cf36d50a1 13660 qt6-5compat_6.11.2-3.debian.tar.xz
 18a4f70c2569edc66d21450b1e49647f17fd8cd881effba658568f4d87cca6d5 12028 qt6-5compat_6.11.2-3_source.buildinfo
Files:
 c23d7bcafb2c6d64392c42cfde5c8c10 2907 libs optional qt6-5compat_6.11.2-3.dsc
 299ffa8a83645246f512ba69ecdd5b55 13660 libs optional qt6-5compat_6.11.2-3.debian.tar.xz
 7fbe0936545764d8f07948923fc0643e 12028 libs optional qt6-5compat_6.11.2-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJq6Ra+CRCen3pgMHf+VkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfFxLewtKjijBKDUXTMrVpCTm2SiY79ZzdEyjIVEpAY
WhYhBGKHQVw0evHMWR7typ6femAwd/5WAAB7ZxAAgpJeXchjsWQHL7EfrZKUYye8
XIAm7NDd56qr/RX14tLyyvu2r55QBnUd6I/48/3lM5tFhVRp038XgsHAc8KRTGS8
wHCrRlz7X8TlfF/sajQu1l3joqQQvSF1oTlI1J1p9thfcNXFzDcmTMxk28ibxBlO
GuJvMFX4YzVEBOosDraa0OUBFwqhpk9Qj3F5doHsV5Jb/BCPNhwC/oeU2PoHsmZR
BVkjGoPkCSJ0Ci/H1W2ORBDvvo0FnDfQAA/Y6fhDaOFGbudIZ058PrpwdexHke2z
542YcQdGMAQgwUpL1n1FukaPVcmuD2BetjaEWeh6ZBbT4lm4lJjXfWBgDAaJhpEW
Egc47f8fkI3qaAVI/8qywGbRXiarSr7ZwDNi8YfU5S1Yqb36RZeT/Px2QuDTKMLm
xYxHrCVi3NIGDzSZbNCpYnitQ8AwjEJhpmZS6GUjGTsSeSuvEvV3Rhak4w4tTj3O
uUB4jTKiuaTJgVEcZ2yXmrGFbuAJE6R4HlMGU33TRaB7xK12jpBcIN5fRyjnEmzj
EDHB771kXCbwM+QTp49rK78v+MzTmS8xHpkfQXHUX1mOSi6Qx9IhPlanDWjI6b5T
LGMs7DNYL6re5abNwmapk7EGlw51w3fhSDdCaGN8iURI6TAnM8agxJ2mpxylr39N
Qu2fWKDMCEDF5VmSLrc=
=1qqM
-----END PGP SIGNATURE-----