CWE-476: NULL Pointer Dereference vulnerabilities

A race condition vulnerability in Nezha Monitoring versions 2.2.7 through 2.2.10 allows a RoleMember to cause a nil pointer dereference in the ServiceSentinel worker. This leads to a panic that terminates the dashboard process, disrupting the web interface, REST API, and agent connections for all tenants. The issue affects availability only and does not expose or modify data. Fixed in version 2.2.11 and later.

CVE-2026-77207 is a high-severity vulnerability in Libreswan affecting versions 4.7 through 5.3.2 and 5.4 through 5.4. It involves a null pointer dereference in the PKCS#7 handling code during IKE certificate authentication. This flaw can be triggered by a malicious IKE_AUTH packet without requiring peer authentication, causing the Libreswan process to crash and restart, resulting in a denial of service. No remote code execution or data compromise is possible.

Libreswan contains a null pointer dereference vulnerability in its IKEv2 state machine's EAP authentication handling. This flaw can be triggered by any IKEv2 connection, even without EAP configured, due to a code inconsistency. A malicious IKE_AUTH packet can cause the pluto daemon to crash and restart, resulting in a denial of service. No remote code execution is possible.

Adobe Substance 3D Designer contains a NULL Pointer Dereference vulnerability (CWE-476) that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.

Adobe Substance 3D Designer contains a NULL Pointer Dereference vulnerability (CWE-476) that can cause the application to crash and result in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability has a medium severity rating with a CVSS score of 5.5.

Adobe Substance 3D Designer contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in denial-of-service. Exploitation requires a user to open a specially crafted malicious file. The vulnerability does not impact confidentiality or integrity but affects availability.

Adobe Substance 3D Designer contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in denial-of-service. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability does not impact confidentiality or integrity but affects availability.

Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS score is 5.5, indicating medium severity.

Adobe Photoshop Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The severity is rated medium with a CVSS score of 5.5.

Adobe Substance 3D Stager contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 3.1.8. The CVSS score is 5.5, indicating medium severity.

Adobe Dimension contains a NULL Pointer Dereference vulnerability (CWE-476) that can cause the application to crash, resulting in denial-of-service. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS score is 5.5, indicating medium severity.

CVE-2026-96953 is a high-severity vulnerability in the Windows Universal Disk Format File System Driver (UDFS) affecting multiple versions of Microsoft Windows 10, including Version 1607. It involves a null pointer dereference that allows an authorized local attacker to execute code. The vulnerability has been officially fixed in specific Windows 10 builds.

CVE-2026-88079 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving a null pointer dereference in the Windows MIDI Service Module. This flaw allows an authorized local attacker to elevate privileges. The issue affects specific builds prior to fixed versions released by Microsoft. An official fix is available and users should apply the updates to mitigate the risk.

CVE-2026-88076 is a null pointer dereference vulnerability in Windows Installer affecting Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 10 builds.

CVE-2026-83665 is a null pointer dereference vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by triggering the null pointer dereference. The vulnerability has a high severity rating with a CVSS score of 7.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-83636 is a vulnerability in Microsoft Windows 10 Version 21H2 involving a null pointer dereference in the Windows Hyper-V component. This flaw allows an authorized local attacker to cause a denial of service condition. The vulnerability affects multiple builds of Windows 10 21H2 and related versions prior to specific fixed releases. The issue has been assigned a CVSS v3.1 score of 6.5, indicating a medium severity level. An official fix is available from Microsoft.

CVE-2026-97767 is a high-severity double free vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network. The issue has been officially fixed in multiple versions of the software.

CVE-2026-85859 is a null pointer dereference vulnerability in the Windows Message Queuing Queue Manager component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to cause a denial of service (DoS) over a network by triggering the null pointer dereference. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this issue.

CVE-2026-84017 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving a null pointer dereference in the Routing and Remote Access Service (RRAS). This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by triggering the null pointer dereference. The vulnerability affects multiple Windows 10 versions prior to their respective fixed updates.

CVE-2026-70248 is a null pointer dereference vulnerability in Windows Hyper-V on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to cause a denial of service by triggering the flaw. The issue affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.