Hi Patrick, On Tue, 03 Nov 2026 22:09:57 +0100 Patrick Franz wrote: > Are you sure that's the correct one ? Because > 08c5ae85586ef9ef6b3f80f98f367de48c6db3d0 is the fix for CVE-2026-107157
Thanks for checking. I went back over it, and I'm fairly confident 08c5ae85586e is the CVE-2026-105924 fix. I think the "Fixed by" note on CVE-2026-107157 in the security tracker is the mistake. 1. What the commit fixes. It is "JSON/CBOR: fix crash converting an empty URL tag to JSON" (QTBUG-149841): a tag-32 URL wrapping an empty string has no ByteData after fromCbor(), and convertExtendedTypeToJson() in qjsoncbor.cpp dereferences the NULL byteData(). The Qt wiki describes the two CVEs as: CVE-2026-105924: "NULL pointer dereference vulnerability in QCborValue to JSON conversion" CVE-2026-107157: "Out-of-bounds read vulnerability in QCborValue::fromCbor()" (64-bit platforms only) The commit only touches qjsoncbor.cpp and the qcborvalue_json test, not the decoder in qcborvalue.cpp. 2. The 6.12 release timing rules out 107157. The wiki lists 107157 as fixed in 6.12.0, but 105924 as affecting 6.12.0 and fixed only in 6.12.1. This fix's 6.12 cherry-pick, a2cd9d2a7057, is on the 6.12 branch but in no tag yet, so it is not in v6.12.0. If it were the 107157 fix, 6.12.0 could not be listed as fixed. (Lineage: dev 9e9988ee57c0 -> 6.12 a2cd9d2a7057 -> 6.11 08c5ae85586e, in v6.11.3.) I couldn't identify the 107157 fix from the public commits. No commit between v6.11.2 and v6.11.3 mentions it, and its Gerrit change (745719) isn't readable for me. So for #1152890 it's best not to rely on 08c5ae85586e. What I said in my earlier mail still stands for #1152892: the patch applies to sid/trixie/bookworm, and I confirmed the crash on 6.11.2 using upstream's regression test. I'll also send a note to the security tracker list about the 107157 entry. Regards, Sumit
