CWE-476: NULL Pointer Dereference vulnerabilities

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference error. To Remediate CVE-2026-22722, apply the patches listed in the "Fixed version" column of the 'Response Matrix'

NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service

A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(ABPM.9.6)C0 and the Zyxel WX3100-T0 firmware versions through 5.50(ABVL.4.8)C0 could allow an authenticated attacker with administrator privileges to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request.

free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).

free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).

free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics due to nil pointer dereference and the SMF process terminates. This is triggered by a malformed PFCP SessionReportRequest on the SMF PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).

free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 have a NULL Pointer Dereference vulnerability. Remote unauthenticated attackers can trigger a service panic (Denial of Service) by sending a crafted PUT request with an unexpected ueId, crashing the UDM service. All deployments of free5GC using the UDM component may be affected.free5gc/udm pull request 76 contains a fix for the issue. No direct workaround is available at the application level. Applying the official patch is recommended.

When BIG-IP AFM or BIG-IP DDoS is provisioned, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-30266 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction but does require authenticated access, limiting the attack surface. The issue has been fixed in Qsync Central version 5.0.0.

CVE-2025-47205 is a medium-severity NULL pointer dereference vulnerability affecting QNAP QTS operating system versions 5.2.x. An attacker with administrator privileges can exploit this flaw to cause a denial-of-service (DoS) condition, disrupting system availability. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 5.1, indicating moderate risk. It has been fixed in QTS 5.2.8.

CVE-2025-47209 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central software, affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability requires no user interaction but does require authenticated access, limiting the attack surface. The issue has been fixed in Qsync Central version 5.0.0.

CVE-2025-48722 is a low-severity NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with an existing user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. The issue has been fixed in Qsync Central version 5.0.

CVE-2025-53598 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central affecting version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, disrupting service availability. The vulnerability does not require user interaction but does require low-level privileges (a user account). The issue has been fixed in Qsync Central version 5.0.0.

CVE-2025-54146 is a low-severity NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction, but does require authenticated access, limiting its exploitation scope. QNAP has addressed this issue in Qsync Central version 5.0.0.

CVE-2025-54147 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability has a low CVSS score of 1.3, reflecting limited impact and exploitation complexity. No user interaction or elevated privileges beyond a user account are required. The issue has been fixed in Qsync Central version 5.