CWE-476: NULL Pointer Dereference vulnerabilities

CVE-2026-48174 is a vulnerability in the NR RRC component of the Samsung Semiconductor Exynos 1280 chipset. It involves improper handling of messages before authentication, which triggers a NULL pointer dereference leading to a data abort and causes a denial-of-service (DoS) condition. A fix was released in September 2026.

CVE-2026-69025 is a vulnerability in the Samsung Semiconductor Exynos 1480 NPU driver where improper validation of user input in the ioctl handler can cause an out-of-bounds write, leading to a denial of service condition. This issue is identified as a NULL Pointer Dereference (CWE-476). A fix is available as of November 2026.

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.

CVE-2026-59993 is a vulnerability in the picotls TLS protocol library used as a client-side TLS stack. A malicious peer can send a HelloRetryRequest followed by a spoofed Hello message that triggers a null-pointer dereference, causing the process to terminate and resulting in denial of service. This issue is fixed in a later commit.

CVE-2026-62966 is a NULL pointer dereference vulnerability in the multipart parser of ESPAsyncWebServer versions prior to 3.11.2. The flaw occurs when handling multipart file uploads, where a null pointer write leads to a StoreProhibited exception, causing a device panic and reboot. This results in a remote denial of service on affected ESP32 devices. The issue requires a route with a non-trivial body or upload handler, such as file upload or web-OTA endpoints. The vulnerability is fixed in version 3.11.2.

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in `OPEN_TYPE_oer.c`, and `OPEN_TYPE_uper_get` in `OPEN_TYPE_uper.c` share the pattern: a conditional null check on `*memb_ptr2` resets presence only when the member exists, but execution then unconditionally computes an inner value from that pointer and a member offset. If the `OPEN TYPE` member has not been allocated, the null-pointer arithmetic and subsequent read cause a segmentation fault. The advisory demonstrates UPER and APER crashes for `E2connectionUpdateAcknowledge`, notes that `E2AP` uses APER, and provides a BER reproducer; OER is also explicitly identified as affected. This issue is fixed in version 1.2.5.

CVE-2026-105924 is a medium severity vulnerability in the Qt Core module involving a NULL pointer dereference during QCborValue to JSON conversion. It affects multiple Qt versions from 5.12.0 through 6.12.0. The issue can cause application crashes or denial of service. A fix is available in Qt version 6.12.1.

A vulnerability in digitalbazaar's forge (node-forge) prior to version 1.4.1 allows a remote peer to trigger an uncaught TypeError during TLS handshake processing. This occurs when a TLS record of another content type interrupts a fragmented handshake message, causing the process to fail and potentially disrupting the connection or hosting process. The issue is fixed in version 1.4.1.

CVE-2026-118778 is a vulnerability in the digitalbazaar forge library (node-forge) prior to version 1.4.1. The TLS client implementation incorrectly checked the wrong property when determining if a server certificate was missing during an RSA key exchange. A malicious TLS server or man-in-the-middle could omit the Certificate message, causing a null pointer dereference that leads to an uncaught exception and termination of the connection or process. This issue is fixed in version 1.4.1.

CVE-2026-111736 is a high-severity vulnerability in RT-Labs P-Net before version 1.0.3. It involves a NULL pointer dereference in the function pf_fspm_cm_read_ind() when processing an implicit read request lacking a valid target AR UUID for a user-specific record index, given that the application has registered a read callback. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the device. The issue is fixed in version 1.0.3.

CVE-2026-111733 is a high-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves a NULL pointer dereference triggered by handling an implicit read request lacking a valid target AR UUID for certain record indices. This flaw allows a remote unauthenticated attacker to crash the device, causing a denial of service.

CVE-2026-57195 is a high-severity vulnerability in Asterisk's Manager Interface (AMI) that allows an unauthenticated attacker to cause a denial of service via a NULL pointer dereference. This occurs when Digest Authentication is used over HTTP and the HTTP server, AMI, and AMI HTTP access are enabled. The HTTP server binds to 127.0.0.1 by default, limiting exposure. The issue is fixed in multiple Asterisk versions including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.

A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.

A signed to unsigned conversion error in ONNX versions from 1.4.0 up to but not including 1.22.0 affects the ScanInferenceFunction and related functions. This flaw allows a missing or negative num_scan_inputs attribute in a model to cause null pointer dereference or excessive memory allocation, potentially disrupting shape inference. The issue is resolved in version 1.22.0.