Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.
resdata is software for reading and writing result files from the Eclipse reservoir simulator. Prior to 6.2.9, resdata insufficiently validates numeric fields, grid dimensions, keyword sizes, and array indexes while parsing untrusted GRDECL files in lib/resdata/rd_kw_grdecl.cpp and lib/resdata/rd_grid.cpp. Malformed COORD, ZCORN, CORSNUM, ACTNUM, or MAPAXES data can reach rd_grid_alloc_GRDECL_kw__ with inconsistent lengths, while unbounded floating-point conversion can exceed the intended parser buffer. In a network service that accepts untrusted GRDECL files, these conditions can cause a classic buffer overflow, out-of-bounds reads, invalid array access, NULL pointer dereference, memory corruption, or service termination. This issue is fixed in version 6.2.9.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the 5G baseband, a NULL Pointer Dereference occurs when processing a malformed RRC Reconfiguration message.
CVE-2026-45747 is a high-severity vulnerability in Suricata prior to version 7.0.16. It involves a NULL pointer dereference in the Lua TLS certificate information helper when Lua scripts request certificate data for TLS traffic missing some certificate fields. This can cause Suricata to crash, resulting in a denial of service. The issue is fixed in version 7.0.16. Workarounds include avoiding Lua scripts that call the TLS certificate information helper on untrusted traffic or updating scripts to handle missing certificate fields.
CVE-2026-66303 is a null pointer dereference vulnerability in Microsoft Skype for Business Server 2015 CU13. It allows an authorized attacker to cause a denial of service (DoS) over the network by triggering the flaw. The vulnerability affects specific versions prior to fixed releases and has a medium severity rating with a CVSS score of 6.5.
CVE-2026-77901 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise, specifically affecting Microsoft Office Word. It involves a null pointer dereference that could allow an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to fixed releases. An official fix is available from Microsoft.
CVE-2026-70575 is a medium severity vulnerability in Microsoft Windows 11 version 23H2 involving a null pointer dereference in the Schannel component. This flaw allows an authorized attacker to cause a denial of service over a network by triggering the null pointer dereference. The vulnerability affects multiple builds of Windows 11 23H2 and related versions prior to their respective fixed releases. An official fix has been released by Microsoft.
CVE-2026-69881 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds, caused by a null pointer dereference in the Windows IKE Extension. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. An official fix is available from Microsoft.
CVE-2026-69384 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds. It involves a null pointer dereference in the Virtual Hard Disk (VHD) Miniport Driver that allows a local unauthorized attacker to cause a denial of service. The issue affects multiple Windows 10 versions prior to specific fixed builds. An official fix is available from Microsoft.
CVE-2026-62762 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions involving a null pointer dereference in Active Directory Domain Services. This flaw allows an authorized attacker to cause a denial of service over the network by triggering the null pointer dereference. The issue affects multiple Windows 10 builds and earlier Windows versions. Microsoft has released official fixes for all affected versions.
CVE-2026-72949 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving a null pointer dereference in the SMB Server Network Transport Driver (srvnet.sys). This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network. The issue affects multiple Windows 11 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-77489 is a high-severity vulnerability in the Windows Biometric Service of Microsoft Windows 10 Version 1607 and related builds. It involves a null pointer dereference that allows an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has issued official fixes for all affected versions.
CVE-2026-72939 is a null pointer dereference vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to cause a denial of service (DoS) over a network by triggering the null pointer dereference. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for all affected versions.
CVE-2026-69744 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving a null pointer dereference in the Windows Kerberos component. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability affects specific builds of Windows 11 24H2 prior to fixed versions 10.0.26100.9445, 10.0.26200.9445, and 10.0.26100.33438. An official fix is available from Microsoft.
CVE-2026-69587 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving a null pointer dereference in the Windows IKE Extension. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by triggering the null pointer dereference. The issue affects multiple builds of Windows 11 23H2 prior to their respective fixed versions. Microsoft has released official fixes for all affected versions.
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.
CVE-2026-18453 is a vulnerability in Red Hat Directory Server 11.5 E4S for RHEL 8 where a missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending crafted search requests using the USE_ONE_BACKEND control. This results in a denial of service by crashing the directory server process, stopping directory lookups and authentication until the service is restarted. There is no impact on confidentiality or integrity, only availability is affected.
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.