Hi,

The security tracker lists CVE-2026-105924 as unfixed for
qtbase-opensource-src, but only qt6-base has a bug (#1152892), so here
is one for Qt 5.

Qt's advisory says Qt 5.12.0 and later are affected:
https://www.google.com/url?q=https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products%23CVE-2026-105924&source=gmail&ust=1793798868725000&sa=E

Upstream fixed it in Qt 6 only:
https://www.google.com/url?q=https://github.com/qt/qtbase/commit/08c5ae85586ef9ef6b3f80f98f367de48c6db3d0&source=gmail&ust=1793798868725000&sa=E
(dev 9e9988ee57c0, in v6.11.3). In convertExtendedTypeToJson()
(src/corelib/serialization/qjsoncbor.cpp), a CBOR URL tag (32) around an
empty text string has no ByteData after QCborValue::fromCbor(), so
d->byteData(1) returns nullptr and is dereferenced. Qt 5.15 has the same
line, but the upstream hunk does not apply (no QT_BOOTSTRAPPED block,
different context).

Confirmed with Debian's libqt5core5t64 5.15.19+dfsg-5 (amd64), using
the same input as the test row the upstream fix adds,
add(QCborValue(QUrl()), QUrl(), QString()):

QCborValue direct{QUrl()}; // encodes as d8 20 60
QCborValue decoded = QCborValue::fromCbor(direct.toCbor());
direct.toJsonValue(); // ok
decoded.toJsonValue(); // SIGSEGV (exit status 139)

The attached patch is a Qt 5 version of the upstream change. It makes
the same guard: if the string has no ByteData, return an empty string.
- applies cleanly with patch --dry-run to 5.15.19+dfsg-6 (sid),
5.15.15+dfsg-6+deb13u1 (trixie) and 5.15.8+dfsg-11+deb12u3
(bookworm); the generated patch is identical for all three
- the patched qjsoncbor.cpp compiles (g++ -std=c++17 -fsyntax-only
against the qtbase5-private-dev 5.15.19 headers), as does the
unpatched one
I have not built the whole package or run the Qt test suite, so the fix
is not runtime-tested here.

Regards