This is the already-public orphan-rescan crash tracked in Ubuntu as LP #1846025:
https://bugs.launchpad.net/ubuntu/+source/cron/+bug/1846025

When an orphaned crontab account becomes resolvable again,
check_orphans() invokes process_crontab() with old_db == NULL. If the
spool file then fails validation (for example, insecure mode or wrong
ownership), process_crontab() calls force_rescan_user(), which
dereferences old_db via find_user(). An isolated ASan/UBSan
reproduction crashed the daemon. The likely trigger is account/NSS
lifecycle plus an invalid protected spool file; ordinary users cannot
directly alter that spool, so attacker control is limited.

The attached one-line guard and focused regression test apply
independently to Debian cron 3.0pl1-212. The regression passes with
the fix and reproduces the crash when reverted. The patched Debian
source built in a disposable trixie container; all 13 existing
integration tests passed. The identical fix has been attached to the
existing Ubuntu report and acknowledged there.

Please consider the patch for Debian and any supported-release
backport. This is a follow-up to a known public issue, not a new
vulnerability claim.

Regards,
Brett Sutton