iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.
CVE-2026-23831 is a medium severity vulnerability in sigstore's Rekor component (versions prior to 1.5.0) involving a NULL pointer dereference triggered by attacker-controlled input. Specifically, when a proposed entry with an empty spec.message is processed, the validate() function incorrectly returns success without initializing sign1Msg, leading to a panic in Canonicalize() when it dereferences the uninitialized pointer. This causes a thread panic resulting in a 500 error response to clients but does not crash the entire service, thus limiting availability impact. No confidentiality or integrity impact is observed. The vulnerability requires no authentication or user interaction and can be triggered remotely via crafted input. The issue has been fixed in version 1.5.
CVE-2025-68141 is a high-severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2025.10.0. It involves a NULL pointer dereference triggered during deserialization of a DC_ChargeLoopRes message containing Receipt and TaxCosts data. Specifically, an out-of-bounds access occurs in the convert function handling DetailedTaxType, causing the module and all EVerest processes to terminate, resulting in denial of service for EV charging stations. Exploitation requires network access but no authentication or user interaction. The vulnerability impacts availability but not confidentiality or integrity. The issue is fixed in version 2025.10.0.
A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS).
When a user executes the 'show chassis' command with specifically crafted options, chassisd will crash and restart. Due to this all components but the Routing Engine (RE) in the chassis are reinitialized, which leads to a complete service outage, which the system automatically recovers from.
This issue affects:
Junos OS on MX, SRX and EX Series, except MX10000 Series and MX304:
* all versions before 22.4R3-S8,
* 23.2 versions before 23.2R2-S5,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S2,
* 24.4 versions before 24.4R2.
Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-8090 is a medium severity vulnerability in BlackBerry's QNX Software Development Platform versions 7.0 and 7.1. It involves a NULL pointer dereference in the MsgRegisterEvent() system call, which can be triggered by an attacker with local access and code execution privileges to crash the QNX Neutrino kernel. This results in a denial of service condition without impacting confidentiality or integrity. Exploitation requires local access but no user interaction or elevated privileges beyond code execution. There are currently no known exploits in the wild and no patches publicly available. The vulnerability primarily affects embedded systems running QNX, commonly used in automotive, industrial, and critical infrastructure sectors. European organizations relying on QNX-based systems could face operational disruptions if exploited. Mitigation involves restricting local access, monitoring for abnormal kernel crashes, and applying vendor patches once released.
NULL Pointer Dereference vulnerability in Apache Nimble.
Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.
This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.
This issue affects Apache NimBLE: through 1.8.0.
Users are recommended to upgrade to version 1.9.0, which fixes the issue.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer dereference vulnerability. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to Null pointer dereference in CIccProfileXml::ParseBasic(), leading to denial of service. This issue has been patched in version 2.3.1.2.
CVE-2026-21503 is a medium severity vulnerability in the InternationalColorConsortium's iccDEV library, affecting versions prior to 2.3.1.2. The flaw arises from improper input validation leading to a null pointer being passed to memcpy() within the CIccTagSparseMatrixArray component, causing undefined behavior and potential application crashes. Exploitation requires local access and user interaction, with no privileges needed, and can result in denial of service due to availability impact. No known exploits are currently reported in the wild. European organizations using iccDEV in color management workflows, especially in printing, graphic design, and imaging sectors, could face service disruptions. Mitigation involves promptly updating to version 2.3.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML tag parser. This issue has been patched in version 2.3.1.2.
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML parser. This issue has been patched in version 2.3.1.2.