CWE-476: NULL Pointer Dereference vulnerabilities

A NULL pointer dereference vulnerability exists in the X.509IF protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The issue is identified as CWE-476 and has a CVSS v3.1 score of 7.5, indicating high severity.

CVE-2026-76927 is a medium severity vulnerability in Wireshark affecting versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. It involves a NULL pointer dereference in the H.245 protocol dissector that can cause the application to crash, resulting in a denial of service. The vulnerability requires local access with high attack complexity and user interaction. No confidentiality or integrity impact is reported.

A NULL pointer dereference vulnerability exists in the CMS protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause the application to crash, resulting in a denial of service condition. The CVSS score is 4.7, indicating medium severity. No known exploits are reported in the wild. There is no explicit patch or remediation information provided in the input data.

A NULL pointer dereference vulnerability exists in the Bluetooth BR/EDR FHS protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.

CVE-2026-8619 is a high-severity unauthenticated denial-of-service vulnerability affecting TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 devices. The issue arises from improper handling of exceptional HTTP request conditions leading to a NULL pointer dereference. A remote attacker on an adjacent network can send a crafted HTTP request to crash the HTTP service process, causing temporary unavailability of the web management interface and HTTP-dependent functions.

A null pointer dereference vulnerability exists in the RTSP service of TP-Link Tapo C100/C101 version 5 devices. An attacker on the local network can send crafted requests that cause the service to dereference an invalid pointer, leading to a service crash and device reboot. This results in disruption of live video streaming and a temporary denial-of-service condition.

CVE-2026-16846 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, where a remote attacker could cause a denial of service due to a null pointer dereference. The vulnerability does not affect confidentiality or integrity but impacts availability. It has a CVSS 3.1 base score of 6.5, indicating medium severity.

CVE-2026-16829 is a medium severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It involves a NULL pointer dereference that could be triggered remotely, leading to a denial of service condition. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

A NULL pointer dereference vulnerability exists in Wekan versions prior to 10.38 in several export API handlers. The handlers improperly assume a user object is always returned from a token lookup, leading to a TypeError and unhandled rejection when an invalid or unknown token is used. This can cause the Wekan process to terminate unexpectedly, resulting in a denial of service. The issue is fixed in version 10.38 by adding proper authentication checks and exception handling.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

A null pointer dereference vulnerability exists in BusyBox up to version 1.30.1 in the FEATURE_WGET_TIMEOUT handler within networking/wget.c. This issue can be triggered by manipulating the -T argument. Local access is required to exploit this vulnerability. A patch identified by commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff has been made available to address this issue. The vulnerability has a CVSS score of 3.3, indicating a medium severity level.

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry contains a malformed coordinate. The coordinate parser in `adagucserverEC/CConvertGeoJSON.cpp` indexes `pt.u.array.values[0]` and `pt.u.array.values[1]` and uses `polygon.u.array.length` as a loop bound without first validating the JSON node type or the coordinate length. A coordinate that is an empty array, a one-element array, a scalar, or `null` leads to an out-of-bounds heap read or a NULL pointer dereference. The same unchecked pattern is present in four geometry branches: `Polygon`, `LineString`, `MultiLineString` and `MultiPolygon`. The vulnerable parser runs whenever the server processes a local GeoJSON file, either a configured GeoJSON dataset or a GeoJSON file exposed through the `AutoResource` feature and requested by an unauthenticated WMS request. A crafted GeoJSON file reliably crashes the backend process that handles that request. Version 7.2.2 patches the vulnerability.

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

CVE-2026-58561 is a null pointer dereference vulnerability in the image codec module of Huawei HarmonyOS version 6.1.0. Successful exploitation may impact system availability, causing potential denial of service. The vulnerability has a medium severity rating with a CVSS score of 4. No public exploits or patches are currently documented.

CVE-2026-58560 is a null pointer dereference vulnerability in the image codec module of Huawei HarmonyOS version 6.1.0. Exploitation of this flaw may lead to a denial of service condition, impacting system availability. The vulnerability has a CVSS 3.1 base score of 4.0, indicating medium severity. No public exploits or patches are currently documented.

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.