Hi,

The following vulnerability was published for qtbase-opensource-src.

CVE-2026-101201[0]:
| A malformed header in the binary file fed to
| QBinaryJson::fromBinaryData() can cause undefined behaviour because
| of out-of-bounds read.

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201

https://github.com/qt/qt5compat/commit/721ed576391211ca53ecdaaecf6dd41df7bc962e
https://github.com/qt/qt5compat/commit/c0a495894d83a3c48055bd1e544f93147fc6ade1

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-101201
https://www.cve.org/CVERecord?id=CVE-2026-101201

Please adjust the affected versions in the BTS as needed.

Hello,

Bug #1152313 in qtbase-opensource-src reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/qt-kde-team/qt/qtbase/-/commit/dc64c5432c8de40e76cfa15a2baf0fd066e0a2b9
------------------------------------------------------------------------
Backport upstream patch to prevent out-of-bounds read in QJsonDocument::fromBinaryData.

Closes: #1152313.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1152313

We believe that the bug you reported is fixed in the latest version of
qtbase-opensource-src, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152313@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dmitry Shachnev <mitya57@debian.org> (supplier of updated qtbase-opensource-src package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 07 Nov 2026 19:53:34 +0300
Source: qtbase-opensource-src
Architecture: source
Version: 5.15.19+dfsg-7
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Dmitry Shachnev <mitya57@debian.org>
Closes: 1151189 1152313 1152937
Changes:
 qtbase-opensource-src (5.15.19+dfsg-7) unstable; urgency=medium
 .
   * Backport upstream patch to prevent out-of-bounds read in QJsonDocument
     fromBinaryData (CVE-2026-101201, closes: #1152313).
   * Backport upstream patch to fix crash converting an empty URL CBOR tag
     to JSON (CVE-2026-105924, closes: #1152937).
   * Backport upstream patch to fix crash when fontconfig fallback pattern
     has no charset (closes: #1151189).
Checksums-Sha1:
 3d2f98d5c23d0fa60f5b6a09fe8ff6b5d17438d3 5470 qtbase-opensource-src_5.15.19+dfsg-7.dsc
 8c703ee587cf63c938ecfea6c655bf50afc85a23 240064 qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz
 fee64825947bbe4479dbac6a702d1f5048071d63 17995 qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo
Checksums-Sha256:
 2172e8d35ead304f624ecbd8cc734e0dc321dc8ecb272837a4e86af2db1873ba 5470 qtbase-opensource-src_5.15.19+dfsg-7.dsc
 a65ebcca7a40b767b91661619fdbbbb31861e878125d8e3954960d0c4e4f7131 240064 qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz
 9b818e04254cf3724ad5fe93b40122fc0ab576ced1b90423f42ea64c1086f7ff 17995 qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo
Files:
 92d6235e24601bc0c314d429567fff99 5470 libs optional qtbase-opensource-src_5.15.19+dfsg-7.dsc
 38033e6d04c7ecf996969baa25d97d9e 240064 libs optional qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz
 86d6b3eb5c7f9daf85ade9595bce567f 17995 libs optional qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE8kKZ/xu8kBi5BqTLYCaTbS8ciuAFAmrvWKgTHG1pdHlhNTdA
ZGViaWFuLm9yZwAKCRBgJpNtLxyK4Db1D/40D6zSZimuXA9A2wJeHdGrkFK+thl8
VRVC/kL9kd+HrH2YzkaA6FRpv4nCI7IpSJmMSd9E/4FmAqs67G/00VyZ+aCY/u3z
kQNjD0x2OgldfUbQdUvcep2y1MLrUiUXIkZXmIjGReCwKpxVZ+wrXavUPESwd90X
HvsnKEivEPk+MJIHGpt6zp/V8PiNHCFt68DZs4DmiOUq29SZobfpA1i50KjLHJH+
S8FaO2BIGmWlJzKcjlXvoNPy7FtPPfcRtgdkQffZ2WOZEOEkRWLZlNOk21PmYCX9
yG0HxVCKjtBaUOKwLaYIcq7xKutWsm7EU9JQtubCmJbaEC+cPlNfbv1b7zTIyLGR
TkgtjUZxuBW3aFljO5YbEIFvFUym2wchhO7ycYM4ucRR19Zl9yTOBK8JIrlG80yO
bL7nDpysaZSJ/mxMrAmmVp6Q8Cpgr4eEP1NIWQbXm5inDVwf/SBcHVJxEfAw0HDb
J3UvcU8OnkjXRsa9N+FYEX4E/E0l+6tvz2CwCDXyGDNUHYbF1YYWvWtWXwHzoVf9
36npCnFNKtt1dC0hGho9wtvO/AEXTo3sLFYCcywTHrn0HwaPiYfPuQUA1WgpQS9Z
GlzwaMjf8dDlr3LBUBHr03/sisfsjHXc91SCoWOG1RUp1ux/A/jOJPc30WyZui6K
6uEy0m77OHEDbA==
=qnQs
-----END PGP SIGNATURE-----