CWE-476 · NULL Pointer Dereference (page 3)
Page 3 of 56 — CVEs classified under CWE-476, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52929 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCT… |
CVE-2026-52925 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from a VRF RCU readers that identified a ne… |
CVE-2026-52922 | High | 7.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadv_dat_forward_data() calls pskb_cop… |
CVE-2026-52913 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: stop OGMv2 on disabled interface When a batadv_hard_iface is disabled, its… |
CVE-2025-55639 | Medium | 6.5 | 2026-06-23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability all… |
CVE-2026-10852 | Medium | 5.9 | 2026-06-22 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component… |
CVE-2026-48139 | High | 7.5 | 2026-06-19 | There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by trig… |
CVE-2026-48985 | Medium | 5.5 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusb_is_loginctl_local() can cause a NULL deref… |
CVE-2026-55204 | High | 7.5 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to v… |
CVE-2026-1288 | Medium | 5.5 | 2026-06-17 | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Suc… |
CVE-2026-0156 | High | 7.5 | 2026-06-16 | In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2025-70102 | Medium | 6.3 | 2026-06-15 | A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:18… |
CVE-2025-55663 | Medium | 5.5 | 2026-06-15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55649 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55643 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55641 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (… |
CVE-2025-7018 | Medium | 5.5 | 2026-06-12 | Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine… |
CVE-2026-53463 | Medium | 4.3 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when passing incorrect… |
CVE-2026-24716 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2026-22899 | Medium | 6.5 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-66281 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-62850 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2026-45541 | High | 7.5 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in… |
CVE-2026-9752 | Medium | 6.5 | 2026-06-09 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polyg… |
CVE-2026-9743 | Medium | 6.5 | 2026-06-09 | In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued o… |
CVE-2025-55659 | Medium | 6.5 | 2026-06-09 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55657 | High | 7.5 | 2026-06-09 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55651 | Medium | 5.5 | 2026-06-09 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2026-34704 | Medium | 5.5 | 2026-06-09 | InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servi… |
CVE-2026-34703 | Medium | 5.5 | 2026-06-09 | InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servi… |
CVE-2026-42903 | Medium | 6.5 | 2026-06-09 | Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network. |
CVE-2026-42767 | Medium | 5.9 | 2026-06-09 | Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impac… |
CVE-2026-42766 | Medium | 5.9 | 2026-06-09 | Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL poin… |
CVE-2026-42765 | High | 7.5 | 2026-06-09 | Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happe… |
CVE-2026-42764 | High | 7.5 | 2026-06-09 | Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation… |
CVE-2026-11788 | Medium | 5.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauth… |
CVE-2026-46313 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed t… |
CVE-2026-46310 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module o… |
CVE-2026-46305 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return v… |
CVE-2026-46296 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from… |
CVE-2026-46284 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix early boot crash on parameters without '=' separator If hugepages, hugepa… |
CVE-2026-46282 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: iio: frequency: admv1013: fix NULL pointer dereference on str When device_property_read_s… |
CVE-2026-46278 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix segfault when updating ftrace mask Fix invalid data access by passin… |
CVE-2026-3238 | High | 7.5 | 2026-06-08 | A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types d… |
CVE-2026-46269 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree When probing… |
CVE-2026-46261 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() platform_get_re… |
CVE-2026-46258 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Avoid NULL dereference in linehandle_create() In linehandle_create(), there i… |
CVE-2026-46245 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see conne… |
CVE-2025-71313 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL check for alloc_workqueue() alloc_workqueue() can return… |
CVE-2025-60477 | Medium | 5.0 | 2026-06-03 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows atta… |
CVE-2026-8035 | High | 7.1 | 2026-06-02 | Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL poi… |
CVE-2026-10298 | Low | 3.3 | 2026-06-01 | A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c… |
CVE-2025-59606 | High | 7.8 | 2026-06-01 | Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization. |
CVE-2025-59604 | High | 7.8 | 2026-06-01 | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
CVE-2026-28581 | Medium | 4.0 | 2026-06-01 | In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lea… |
CVE-2025-70099 | High | 7.5 | 2026-06-01 | A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supp… |
CVE-2026-45729 | Medium | 4.3 | 2026-06-01 | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer dereference in SvgLoader::run() allows any c… |
CVE-2026-37230 | High | 7.5 | 2026-06-01 | FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup returns NULL… |
CVE-2026-37226 | High | 7.5 | 2026-06-01 | FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, which is en… |
CVE-2025-60495 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a… |
CVE-2025-60485 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a De… |
CVE-2025-60483 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attac… |
CVE-2025-60481 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2026-10199 | Low | 3.3 | 2026-05-31 | A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of… |
CVE-2026-10198 | Low | 3.3 | 2026-05-31 | A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of… |
CVE-2026-10197 | Low | 3.3 | 2026-05-31 | A vulnerability was detected in Assimp up to 6.0.4. Affected is the function glTF2Importer::ImportEmbeddedTextures in the library code/AssetLib/glTF2/glTF2Impo… |
CVE-2026-46527 | High | 7.5 | 2026-05-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() wit… |
CVE-2026-45151 | | 2026-05-29 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a s… | |
CVE-2026-47337 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can… |
CVE-2026-47335 | Medium | 5.5 | 2026-05-28 | Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an unpr… |
CVE-2026-47327 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be trigger… |
CVE-2026-46235 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and cleanups Add checks for ioremap return valu… |
CVE-2026-46233 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims When batadv_bla_purge_claims() goes throu… |
CVE-2026-46222 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads The pads missed checks for… |
CVE-2026-46216 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() When media GT i… |
CVE-2026-46211 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_g… |
CVE-2026-46195 | Critical | 9.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_se… |
CVE-2026-46188 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: octeon_ep_vf: add NULL check for napi_build_skb() napi_build_skb() can return NULL on all… |
CVE-2026-46134 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration cros_typec_registe… |
CVE-2026-46127 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Sashiko points out… |
CVE-2026-46118 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d… |
CVE-2026-46114 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infinib… |
CVE-2026-46110 | High | 7.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the… |
CVE-2026-44710 | Medium | 4.6 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_se… |
CVE-2026-9759 | Medium | 5.5 | 2026-05-27 | ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service |
CVE-2026-8360 | High | 7.5 | 2026-05-27 | Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL point… |
CVE-2026-8359 | High | 7.5 | 2026-05-27 | When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_Lo… |
CVE-2026-48066 | Medium | 5.7 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is wri… |
CVE-2026-47271 | Medium | 5.1 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc(), xr… |
CVE-2026-45104 | High | 7.5 | 2026-05-27 | MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLay… |
CVE-2026-44328 | High | 8.2 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 mid… |
CVE-2026-44323 | Medium | 4.3 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subs… |
CVE-2026-44322 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/appl… |
CVE-2026-44317 | Medium | 6.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on… |
CVE-2026-44316 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateS… |
CVE-2025-70116 | Medium | 4.3 | 2026-05-27 | A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g… |
CVE-2026-8180 | High | 7.5 | 2026-05-27 | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera… |
CVE-2026-46098 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an exi… |
CVE-2026-46092 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pci_upstream_bridge() returns NULL i… |