CWE-476: NULL Pointer Dereference vulnerabilities

A NULL pointer dereference vulnerability exists in the NVIDIA GPU Display Driver for Linux kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patch information are provided.

CVE-2026-86134 is a high-severity NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process. It allows a remote, unauthenticated attacker to crash the management daemon by sending a specially crafted request to the login interface, causing a denial of service. Fixed versions are available.

CVE-2026-86136 is a high-severity vulnerability in WatchGuard Fireware OS affecting multiple versions prior to fixed releases. It involves a missing authorization check in the wgagent management daemon's session initialization, allowing an authenticated low-privileged user, including read-only or guest administrators, to crash the wgagent process and read arbitrary files accessible to the daemon via specially crafted management API requests.

CVE-2026-86128 is a high-severity vulnerability in WatchGuard Fireware OS involving a NULL pointer dereference in the NetFlow packet-processing feature. This flaw allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet. The issue affects multiple versions of Fireware OS prior to their respective fixed releases.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing vulnerabilities in the hdf5 packages. The update includes multiple hdf5-related RPMs for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. No explicit patch version ranges are provided, but updated package versions are listed. The severity is assessed as medium.

A NULL pointer dereference vulnerability exists in Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a when built with VLAN and SRP support. The flaw occurs when evicting the last attribute in an MRP participant's list, causing a write through a null successor pointer. This can be triggered by an unauthenticated station on the same Layer 2 segment by declaring and withdrawing an MSRP attribute, potentially faulting the MRP worker thread.

CVE-2026-102723 is a high-severity vulnerability in Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a when built with VLAN and SRP support. It involves a NULL pointer dereference caused by the MSRP attribute lookup writing through a null pointer when the attribute table is full. An unauthenticated attacker on the same Layer 2 segment can trigger this fault by declaring enough new attributes, leading to a fault in the MRP worker thread. Talker Failed declarations exacerbate the issue by holding table entries indefinitely.

CVE-2026-102623 is a vulnerability in Red Hat OpenShift Virtualization 4's KubeVirt component where an authenticated user with permission to create Virtual Machine Instances can cause a denial of service. This occurs by submitting a virtual machine definition containing an empty ephemeral volume, which leads the virt-controller to crash due to improper validation. The crash causes the controller to enter a continuous crash loop, disrupting virtual machine lifecycle operations cluster-wide.

A NULL pointer dereference vulnerability exists in Wireshark versions 4.6.0 through 4.6.8 in the PEAK CAN TRC file parser. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5.

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe InDesign Desktop contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. This vulnerability affects versions up to 21.5 and 20.5.4. The issue does not impact confidentiality or integrity but affects availability.

Envoy proxy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain a vulnerability in the ext_authz filter where improper input validation of path-less CONNECT requests can cause a null pointer dereference. This occurs when the filter attempts to mutate query parameters based on an authorization response but the request lacks the expected :path pseudoheader. An unauthenticated downstream client can exploit this to crash the Envoy process, resulting in a denial of service. The issue is fixed in the specified versions.

CVE-2026-48521 is a NULL pointer dereference vulnerability in Envoy proxy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1. The flaw occurs in the ProdClusterManagerFactory::allocateConnPool function when selecting an HTTP/3 connection pool without checking if transport_socket_options is null. This can cause an Envoy worker to crash when certain LoadBalancerContext implementations return no transport-socket options and HTTP/3 is enabled.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.

A vulnerability in libxml2 used by Red Hat Hardened Images allows a local user or attacker to cause a denial of service by triggering a NULL pointer dereference during XML catalog parsing. This happens when a nextCatalog element is missing its required catalog attribute, causing the application to crash. The flaw requires user interaction and specially crafted XML input. A security update addressing this issue is available.

Control iD iDSecure versions prior to 4.8.3.0 contain a vulnerability that allows unauthenticated denial of service due to a null pointer dereference. The issue occurs at the /api/dguardintegration/dguardVersion endpoint when it dereferences an unset DGuard integration login state, causing an unhandled null reference exception. This exception is thrown from an asynchronous void method, which terminates the iDSecure process without being caught.

CVE-2026-77692 is a high-severity vulnerability in ISC BIND 9 that causes the DNS server process 'named' to abort when processing a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by premature connection closure. This results in a denial of service condition without impacting confidentiality or integrity.

A security flaw in GNU Binutils 2.47 affects the elf_orphan_compatible function in the ELF Orphan Section Handler, causing a null pointer dereference. Exploitation requires local access and can result in limited confidentiality, integrity, and availability impacts. Public exploit code exists, but no vendor patch or official fix has been issued yet. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.