CWE-476: NULL Pointer Dereference vulnerabilities

CVE-2025-59606 is a high-severity vulnerability in Qualcomm Snapdragon platforms that causes memory corruption due to a NULL pointer dereference triggered by heap memory exhaustion during secure data initialization. This flaw affects a wide range of Qualcomm Snapdragon products and platforms. The vulnerability can lead to high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet by the vendor.

CVE-2025-59604 is a high severity vulnerability in Qualcomm Snapdragon devices involving a NULL pointer dereference that causes memory corruption during a memory copy operation. This issue can lead to high impact on confidentiality, integrity, and availability. No affected versions or patch information are currently provided.

cpp-httplib versions prior to 0.44.0 contain a vulnerability when the server uses a non-empty trusted proxy list via Server::set_trusted_proxies(). An attacker can send an HTTP request with a malformed X-Forwarded-For header that leads to undefined behavior by causing the server to access an empty vector, resulting in abnormal process termination (denial of service). This issue is fixed in version 0.44.0.

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.

Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel panic.

Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unprivileged local user. This can lead to a kernel oops.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to strcmp() without NULL checks. The GIO/UDisks API documentation states these accessors can return NULL for devices that do not expose the corresponding field. Passing NULL to strcmp() is undefined behaviour (typically a SIGSEGV). This vulnerability is fixed in 0.8.7.

CVE-2026-47271 is a NULL pointer dereference vulnerability in pam_usb versions prior to 0.9.0. The issue arises because out-of-memory guards implemented with assert() are compiled out in release builds, causing allocation functions to return NULL without checks. This leads to a crash in the PAM module when memory allocation fails, resulting in a local denial-of-service by preventing authentication via sudo or login. The vulnerability is fixed in version 0.9.0.

CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.

CVE-2026-8359 is a high-severity vulnerability in Gladinet Triofox caused by a NULL pointer dereference. The issue arises when processing requests with URL paths starting with /status or /sysinfo, which require loading the WOSHttpStatusModule.dll. Since this DLL is missing from the installation, the function pointer to WOSBin_LoadHttpModule is set to NULL, leading to a call at address 0 and causing a denial of service.

CVE-2026-8360 is a high-severity vulnerability in Gladinet Triofox involving a NULL pointer dereference. The issue arises when function calls to WOSCommonUtil.dll! WOSSysInfoGetDeviceInterface() return a NULL pointer if no user is logged into the Triofox Server Agent Management Console. This NULL pointer is not checked before being dereferenced in various DLLs, potentially causing a denial of service. The vulnerability has a CVSS score of 7.5, indicating a significant impact on availability without affecting confidentiality or integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A NULL pointer dereference vulnerability exists in the ROHC protocol dissector of Wireshark versions 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15. This flaw can cause the application to crash, resulting in a denial of service condition.

A high-severity vulnerability (CVE-2026-8180) affects IBM Aspera High-Speed Transfer Endpoint and Server versions 3.7.4 through 4.4.7 Fix Pack 1. The issue is a NULL pointer dereference in the asperahttpd component that can be triggered by an unauthenticated user, causing the service to crash and resulting in a denial of service. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload.

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service impact. Product is only affected if IEC 60870-5-104 functionality in bidirectional mode (BCI) is configured.

In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.