CWE-476: NULL Pointer Dereference vulnerabilities

CVE-2026-78222 is a high-severity vulnerability in F5 NGINX JavaScript where a malformed HTTP response processed by ngx.fetch() can cause a NULL pointer dereference when trusted JavaScript reads Response.statusText, leading to an NGINX worker crash and denial-of-service. Exploitation requires control or influence over the fetched HTTP response. This issue affects versions from 0.5.1 up to but not including 1.0.1. There is no control plane exposure; the impact is limited to the data plane. No known exploits are reported in the wild. Versions that have reached End of Technical Support are not evaluated.

NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.

CVE-2026-76650 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link TL-WR841N v14. It occurs when processing SOAP state variable query requests, potentially causing the UPnP service process to terminate unexpectedly or become unstable. Exploitation results in a denial-of-service condition affecting UPnP discovery and management functions until the process is restarted or the device rebooted. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or official remediation guidance is currently available.

CVE-2026-76649 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link System Inc.'s TL-WR841N v14 router. It occurs when processing specially crafted SOAP action requests containing unexpected XML content, causing the UPnP daemon to terminate unexpectedly. Successful exploitation results in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or official remediation information is currently available.

CVE-2026-81490 is a high-severity vulnerability in the MongoDB BI Connector where a database user can create a specially crafted view that causes the schema-sampling routine to fail. This failure leads to the mongosqld process running without a usable schema, preventing SQL clients from obtaining query results until the problematic view is removed or excluded from sampling.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the rmtIP parameter to cause the CGI process to dereference a null pointer and crash, resulting in denial of service of the web management interface.

Adobe Substance 3D Designer contains a NULL Pointer Dereference vulnerability that can cause the application to crash, resulting in a denial-of-service condition. Exploitation requires user interaction, specifically opening a malicious file. This vulnerability does not impact confidentiality or integrity but affects availability.

NVIDIA DGX Spark system firmware contains a NULL pointer dereference vulnerability (CWE-476) that could be exploited by a privileged attacker. Exploitation may result in code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability has a high severity CVSS score of 8.2. No patch or remediation information is currently available from the vendor.

OpenEXR versions 3.4.0 through 3.4.12 contain a vulnerability in the exr_attr_set_bytes() function where improper input validation of a nested pointer leads to a NULL pointer dereference. This flaw can cause a deterministic crash resulting in denial of service. The issue is fixed in version 3.4.13.

CVE-2026-78148 is a medium severity vulnerability in the ggml-org llama.cpp project. It involves a null pointer dereference in the rpc_server::graph_compute function of the ggml-RPC Server component. This flaw can be triggered remotely and may cause a denial of service. A fix has been proposed but is not yet merged or officially released.

A NULL pointer dereference vulnerability exists in kin-openapi versions from 0.10.0 up to but not including 0.141.0. The issue occurs in the openapi3filter.convertParseError function, which dereferences a nil Parameter field without checking. This can cause applications rendering validation errors to panic when processing malformed multipart/form-data requests. The vulnerability allows unauthenticated clients to cause a denial of service by repeatedly sending such requests. The issue is fixed in version 0.141.0.

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

CVE-2026-47753 is a NULL pointer dereference vulnerability in the Incus system container and virtual machine manager prior to version 7.1.0. An authenticated user with permission to create instances can trigger a daemon crash by uploading a crafted backup tarball, causing denial of service across all projects on the affected cluster member. The issue arises from a missing null check on the Volume field in the instance-import path. Version 7.1.0 includes a patch that addresses this vulnerability.

CVE-2026-48754 is a NULL pointer dereference vulnerability in the Incus container and virtual machine manager prior to version 7.1.0. It occurs in the function createDependentVolumesFromBackup when processing dependent volume entries with missing or nil snapshot, volume, or pool pointers. An authenticated user with can_create_instances permission can crash the incusd daemon by uploading a specially crafted instance backup tarball. The issue is fixed in version 7.1.0.

CVE-2026-48756 is a low-severity NULL pointer dereference vulnerability in the Incus system container and virtual machine manager prior to version 7.1.0. An authenticated user with permission to create storage volumes can crash the incusd daemon by uploading a specially crafted backup tarball missing the expires_at field in volume snapshots. The issue arises from an unguarded dereference of a nullable time pointer in the storage backend code. Version 7.1.0 includes a patch that fixes this flaw.

CVE-2026-17165 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a remote attacker to cause a denial of service via a NULL pointer dereference. This vulnerability does not impact confidentiality or integrity but results in service disruption.

CVE-2026-17009 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, where a local attacker can cause a denial of service by triggering a NULL pointer dereference. This issue does not impact confidentiality or integrity but affects availability. The vulnerability requires local access with low privileges and high attack complexity. No public exploits are known, and no patch information is provided.

CVE-2026-63380 is a use-after-free vulnerability in libevent prior to version 2.2.2-alpha. It occurs in the WebSocket session handling code when an error path is taken after a successful WebSocket start but a locking operation fails. This leads to an invalid list pointer dereference and potential process crash. The issue is fixed in libevent version 2.2.2-alpha.