CWE-476: NULL Pointer Dereference vulnerabilities

CVE-2026-96432 is a low-severity vulnerability in the Qt Network module affecting versions 6.8.0 through 6.8.9 and 6.9.0 through 6.11.2. It involves a null pointer dereference in the QNetworkAccessManager class triggered by a malicious or compromised HTTP/2 server that withholds SETTINGS ACK, sends RST_STREAM on a completed stream, and then issues a PUSH_PROMISE for that stream, causing the application to crash.

A NULL pointer dereference vulnerability exists in RT-Labs AB SOEM versions 2.0.0 and earlier. This flaw allows a malicious device to crash the master system by sending a specific sequence of two messages. The software clears an internal pointer upon receiving an error response but continues processing, leading to a crash if another message arrives before timeout. The issue is fixed in version 2.0.1.

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

CVE-2026-112381 is a vulnerability in Apache Traffic Server that causes a crash due to a null pointer dereference. This occurs when a client POST request is half-closed while a chunked origin response is being reparsed in a reentrant write-ready callback. The issue is timing-dependent and was introduced by backports related to CVE-2021-32564. Affected versions include 9.2.15, 10.1.4, and 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.

CVE-2026-96888 is a high-severity vulnerability in ISC BIND 9 affecting versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and their respective S1 variants. The issue occurs when a BIND resolver is configured with both a "redirect" zone and "qname-minimization strict" enabled, leading to an assertion failure and abort due to a NULL pointer dereference during redirect processing.

CVE-2026-90484 is a null pointer dereference vulnerability in the MySQL client response parser of Apache bRPC. It occurs when the server sends a zero-payload-length response packet, causing the client to dereference a null pointer and crash. This can lead to denial of service for the client when connecting to a malicious or compromised MySQL server or a man-in-the-middle. The issue is fixed in Apache bRPC version 1.18.0 by rejecting zero-length response packets before reading the type byte.

CVE-2026-82953 is a medium-severity vulnerability in Apache bRPC versions prior to 1.18.0. It involves a NULL pointer dereference in the RTMP protocol implementation that can be triggered remotely by sending a crafted createStream command and then closing the connection prematurely. This causes the server process to crash, resulting in a denial of service.

CVE-2026-78058 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0 affecting the HTTP/2 receive path. It allows remote unauthenticated attackers to crash the server or cause unbounded memory growth by sending crafted HTTP/2 frames. The vulnerability arises because the server does not enforce advertised receive-side limits, leading to excessive concurrent streams, oversized header lists, unchecked control-frame acknowledgments, and HPACK dynamic table desynchronization. This affects any bRPC server or client communicating over HTTP/2 or gRPC on untrusted networks. The issue is fixed in version 1.18.0, which enforces limits on concurrent streams, header list size, and control-frame acknowledgments by default.

CVE-2026-105923 is a medium severity vulnerability in Qt affecting the VectorImage QML Type. A malicious SVG file can cause an integer overflow that leads to a null-pointer dereference, potentially causing application crashes or denial of service. The issue affects Qt versions from 6.8.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.3. Fixed versions are 6.8.9 and 6.11.3.

A NULL pointer dereference vulnerability exists in the python-pillow Pillow library's Image.merge() function when processing certain single-band images of mode 'I' or 'F'. The function skips validation for band 0, leading to a crash when a crafted file is loaded via the IPTC plugin. This causes a hard crash of the process, not a catchable Python exception.

CVE-2026-112392 is a NULL pointer dereference vulnerability in the python-pillow Pillow library affecting versions prior to 13.0.0. The flaw occurs in the ImagingExpand function when applying median, minimum, maximum, or rank filters to zero-width or zero-height images, causing the Python process to crash with a segmentation fault. This happens because the function attempts to read edge pixels without verifying that the image contains any pixels, leading to a NULL pointer dereference. The issue can be triggered by supplying crafted crop coordinates or multi-page TIFF files with zero-length pages. The vulnerability results in denial of service by crashing the process, with no memory corruption or data disclosure. A fix is available in Pillow version 13.0.0.

A vulnerability in Gitea versions up to 28.1.0 causes an uncaught exception when requesting the repositories page for an individual user instead of an organization. This triggers a nil pointer dereference leading to a server panic and HTTP 500 error. The issue requires no authentication and can be triggered by any user. The fix changes the response to return a 404 error for individual users, preventing the panic.

A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.

A NULL pointer dereference vulnerability exists in kin-openapi versions from 0.136.0 up to but not including 0.149.0. This flaw allows an unauthenticated remote attacker to cause a deterministic panic by sending crafted requests with array query parameters or specific request bodies. The issue arises from missing nil-items guards in certain decoder paths handling OpenAPI 3.1 array schemas. The vulnerability is fixed in version 0.149.0.

CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.

CVE-2026-100348 is a medium severity vulnerability in the kin-openapi library's openapi3 loader component. It involves a NULL pointer dereference in the resolveComponent function when processing additionalProperties in schema references. This occurs because the code dereferences c.Value.AdditionalProperties without checking if c.Value is nil, leading to a panic during loading of crafted OpenAPI documents. The issue affects kin-openapi versions prior to 0.145.0 and can cause denial of service by crashing applications that load untrusted OpenAPI specifications.

kin-openapi versions from 0.136.0 up to but not including 0.143.0 contain a vulnerability where the openapi3filter component improperly handles OpenAPI 3.1 array schemas missing the 'items' keyword. This leads to a nil-pointer panic during request or response validation when decoding certain content types. The issue does not affect OpenAPI 3.0 documents. The vulnerability is fixed in version 0.143.0.

CVE-2026-24723 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

CVE-2026-24722 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

CVE-2026-24721 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.