CVE-2026-83648 is a vulnerability in Microsoft Windows 10 Version 21H2 involving a null pointer dereference in Active Directory Domain Services. This flaw allows an authorized attacker to cause a denial of service over the network. The issue affects multiple builds of Windows 10 21H2 prior to specific fixed versions. A patch is available from Microsoft to address this vulnerability.
CVE-2026-83571 is a vulnerability in the Windows Audio Service of Microsoft Windows 10 Version 1607 and other versions. It involves a null pointer dereference that allows an authorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-69978 is a null pointer dereference vulnerability in the Windows VMSwitch component affecting multiple builds of Microsoft Windows 10 Version 1809 and later. An authorized local attacker with low privileges can cause a denial of service by triggering this flaw. The vulnerability has a medium severity score of 5.6 and has been officially fixed in specific Windows 10 builds.
CVE-2026-69795 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds involving a null pointer dereference in the Windows Clipboard Server. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-70566 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving a null pointer dereference in the Schannel component. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
Adobe FrameMaker 2026 contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires a user to open a specially crafted malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS score is 5.5, indicating medium severity.
CVE-2026-104004 is a high-severity vulnerability in MongoDB Server affecting certain versions. It involves a NULL pointer dereference in the collection validation feature, which can cause the server process to crash when a document is inserted. This issue affects authenticated users with write access. The vulnerability exists in MongoDB Server versions >=8.0 and <8.0.34, >=8.3.0 and <8.3.13, and >=9.0 and <9.0.4.
CVE-2026-77095 is a high-severity vulnerability in Commvault Cloud involving a NULL pointer dereference that affects service availability. It impacts multiple Commvault components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. The issue is resolved in maintenance releases, and users are advised to upgrade to these fixed versions.
CVE-2026-109942 is a NULL pointer dereference vulnerability in FreeRDP versions 2.3.0 before 3.32.0. It occurs in the rdg_process_close_packet function when processing a header-only CLOSE_CHANNEL packet without payload validation. A malicious or compromised RD Gateway can send a crafted packet to crash the FreeRDP client.
CVE-2026-109939 is a NULL pointer dereference vulnerability in FreeRDP versions 3.27.1 before 3.32.0. It occurs in the update_read_cache_bitmap_v3_order() function when the client bitmap cache is accessed without being initialized, triggered by a malicious or compromised RDP server sending a Cache Bitmap V3 order during connection setup. This affects clients using the non-default Bitmap Cache V3 feature and can cause the client to crash.
A use-after-free vulnerability exists in ImageMagick versions 7.1.0-20 before 7.1.2-32 in the -fx option. This occurs when memory allocation fails during a specific operation, allowing attackers who can supply crafted -fx expressions under memory pressure to trigger access to freed memory, potentially causing crashes or memory corruption.
A NULL pointer dereference vulnerability exists in ImageMagick versions 7.1.1-31 before 7.1.2-32 in the PostScript decoder. This flaw is triggered when a policy limit is reached and can be exploited by processing a crafted PostScript file, causing the application to crash and resulting in a denial of service.
A NULL pointer dereference vulnerability exists in ImageMagick versions 7.1.0-20 before 7.1.2-32 in the fx operation. This occurs when initialization of an FX runtime entry fails, leading to an invalid memory free. Exploitation can cause memory corruption and application crashes.
FreeRDP versions 3.9.0 through before 3.32.0 contain a NULL pointer dereference vulnerability in the RDPEAR NDR reader. This flaw allows malicious servers to crash FreeRDP clients by sending malformed CreateApReqAuthenticatorReq requests with truncated KERB_RPC_INTERNAL_NAME data. The vulnerability arises when the NameCount is two or more but the Names pointer is truncated, causing a null pointer dereference during cleanup and client termination.
FreeRDP versions before 3.32.0 have a NULL pointer dereference vulnerability in the client video redirection channel. Malicious servers can exploit this by sending out-of-order messages, specifically a Geometry CLEAR message followed by VideoData, causing the client to dereference a null pointer and crash. This results in a denial of service condition for the client.
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
CVE-2026-107655 is a vulnerability in CUPS used in Red Hat Hardened Images where improper handling of specific IPP attributes in embedded job ticket comments causes a null pointer dereference. This flaw allows an unauthenticated attacker with permission to submit print jobs to a shared printer queue to send a crafted IPP request that crashes the print daemon, resulting in a temporary denial of service for printing services. A security update addressing this issue is available from Red Hat.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
SumatraPDF versions 3.6.1 and earlier contain a NULL pointer dereference vulnerability in the FrameOnCommand() function when handling CmdExec commands. This occurs if no document tab is open, allowing a local process with appropriate integrity level to cause the application to crash by dispatching CmdExec via DDE or WM_COPYDATA. The impact is limited to abrupt termination and loss of unsaved state, with no broader effects reported. No fix is currently available.