CWE-476: NULL Pointer Dereference vulnerabilities

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().

A null pointer dereference vulnerability exists in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This flaw could allow a remote attacker to cause a denial of service condition by triggering the null pointer dereference.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.

CVE-2026-107222 is a medium severity vulnerability in the qax-os excelize Go library versions 2.7.0 through 2.11.0. It involves improper validation of array indexes during conditional-format extraction, which can cause out-of-range indexing or nil dereferences when processing malformed worksheet rules. This can lead to a panic that terminates an unprotected process. No fixed version is currently available.

CVE-2026-107213 is a high-severity vulnerability in the qax-os excelize Go library versions 2.9.0 through 2.11.0. The flaw is a NULL pointer dereference caused by the GetSlicers function accessing a worksheet drawing element without verifying its existence. This can cause the application to panic and terminate when processing a crafted Excel worksheet containing an extLst element but lacking the drawing element. No fix is currently available for this issue.

CVE-2026-102169 is a medium severity vulnerability affecting Arista Networks Wi-Fi Access Points with Captive Portal enabled. An unauthenticated wireless client connected to a captive-portal-enabled SSID can send a crafted HTTP request that causes a NULL pointer dereference, crashing the portal service. Although the service restarts automatically, a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.

CVE-2026-93316 is a high-severity vulnerability in moby BuildKit where starting the daemon with the --cdi-disabled option can cause a NULL pointer dereference, leading to a daemon panic if builds attempt to use CDI devices. This can occur either accidentally or through malicious actions. The affected versions are all BuildKit versions from 0 up to but not including 0.33.1.

CVE-2026-66859 is a high severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves a NULL Pointer Dereference and use of uninitialized variable in the c_glib bindings. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVE-2026-82357 is a NULL pointer dereference vulnerability in RT-Labs AB C-Open CANopen software. It occurs when the LSS protocol is used to configure a device with a misconfigured identity object lacking required subindexes. An unauthenticated remote attacker with CAN bus access can trigger the vulnerability, potentially causing the device to crash. The issue is fixed in version 1.1.1.

CVE-2026-9032 is a high-severity vulnerability in TP-Link Tapo C120 v1 and C200 v5 devices. It involves a NULL pointer dereference in the HTTPS onboarding connect request parser, which can be triggered by unauthenticated malformed requests from the local network. Exploitation causes the HTTPS management service to crash, resulting in temporary denial of service. Repeated exploitation may sustain this condition and could require a device reboot to recover. Fixed versions are available for both affected device models.

CVE-2026-63686 is a high-severity vulnerability in Apache HTTP Server before version 2.4.69. It involves a NULL pointer dereference in the mod_xml2enc module triggered by a proxied response containing a charset conversion that partially succeeds then fails. This flaw allows an untrusted backend server to cause a denial of service (DoS) by crashing the server process. The issue is fixed in Apache HTTP Server version 2.4.69.

CVE-2026-46729 is a NULL Pointer Dereference vulnerability in the Apache HTTP Server's mod_heartmonitor module when using the unicast listener. It affects Apache HTTP Server versions from 2.4.0 through 2.4.68. This vulnerability can cause a denial of service by crashing the server. The CVSS score is 7.5, indicating a high severity impact due to availability disruption.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver where a local user may cause a null pointer dereference by submitting a crafted ioctl. A successful exploit of this vulnerability might lead to denial of service.