Null Pointer Dereference

NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.

Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.

Null pointer dereference in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allows remote authenticated attackers to crash the web management interface by sending a crafted request. The web_poe_alive_rmtip_post handler in /cgi-bin/dispatcher.cgi dereferences the rmtIP POST parameter without first validating its presence, meaning a missing parameter is dereferenced as NULL, faulting the CGI process and rendering the web management interface unavailable. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the trigger is trivially simple - a single omitted parameter - for any attacker already holding administrative credentials.

NULL pointer dereference in Wazuh agent enrollment (versions 4.0.0-4.14.6) allows a network-positioned attacker operating a rogue manager or performing a man-in-the-middle attack to deterministically crash the agent process by supplying a malformed key response containing fewer than four space-separated fields. The flaw resides in `w_enrollment_process_agent_key()` in `src/shared/enrollment_op.c`, which passes unvalidated NULL entries from `OS_StrBreak()` directly into `OS_IsValidName()`, where an unguarded `strlen()` call on a NULL pointer terminates the agent. The attack is constrained by high complexity conditions (no CA certificate configured, or active MITM capability), and no public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in Wazuh 4.14.7.

NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.

Null pointer dereference in Stomper (commit 5e2741e) allows any remote unauthenticated client to crash the STOMP server process by sending a SEND frame with the destination header omitted. The crash is deterministic and repeatable, making sustained denial-of-service trivially achievable without credentials or prior session state. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.15% (5th percentile) indicates low current exploitation probability, but the attack complexity is minimal for any attacker with network access to the service.

Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.

Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).

NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.

NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.

Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.

NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.

Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.

Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the `pass` field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.

Null pointer dereference in DrayTek VigorSwitch's formlogout web management function allows authenticated remote administrators to crash the management service, causing a denial of service across 28+ switch models spanning the G, P, Q, FX, and PX product lines. The flaw stems from absent validation of an empty or missing Cookie header before string handling in the formlogout handler, and is patched in firmware versions released under DrayTek's August 2026 security advisory. No public exploit code or CISA KEV listing is referenced in the available data.

Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.

Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.

NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.

Remote denial of service in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker via a NULL pointer dereference (CWE-476) in a network-accessible component, yielding full availability loss against affected systems. The vulnerability carries a CVSS 7.5 High score with no confidentiality or integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis.

NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.

Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.

Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network.

Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.

Null pointer dereference in Wireshark's H.245 protocol dissector crashes the application, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An attacker can trigger the crash by inducing a victim analyst to open a crafted packet capture file or by injecting malicious H.245 traffic into a live capture session. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, indicating no confirmed active exploitation.

Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.

Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.

Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Process-terminating denial of service in Wekan's export API (versions prior to 10.38) allows an attacker to crash the entire server with a single crafted GET request. Four export handlers in models/export.js and models/exportExcel.js called user._id.toString() on the undefined result of ReactiveCache.getUser() without a null guard; supplying an invalid authToken query parameter to any export endpoint triggers a TypeError that propagates as an unhandled async rejection and terminates the Meteor/Node.js process, denying service to all concurrent users. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog, though the attack path is trivially reproducible given the explicit description and public commit diff.

Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.

IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.

The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog based on available data.

BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. No public exploit has confirmed active production exploitation, but a public proof-of-concept is available and the CVE is not listed in CISA KEV.

NULL-pointer dereference in kin-openapi's request validation pipeline (versions 0.2.0 through 0.143.0) enables any unauthenticated remote client to crash request validation with a single crafted HTTP request. The defect resides in defaultContentParameterDecoder within openapi3filter/req_resp_decoder.go, where mt.Schema.Value is dereferenced without a nil guard when a content parameter's application/json media type declares no schema - a construct that is explicitly valid under both OpenAPI 3.0.x and 3.1.x, meaning doc.Validate() will not surface the issue at startup. Depending on integration depth, an attacker can cause either unbounded panic-log growth or a complete process crash; no public exploit or CISA KEV listing exists at time of analysis, and the vendor released a confirmed fix in v0.144.0.

Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the device by sending a crafted request to the setWizardCfg function in /cgi-bin/cstecgi.cgi, triggering a null pointer dereference. Impact is limited strictly to availability - no confidentiality or integrity compromise - but a publicly available proof-of-concept exploit on GitHub (CVSS 4.0 E:P) significantly lowers the exploitation barrier. No vendor patch has been identified and the device is not listed in CISA KEV, making access restriction to the management interface the primary mitigation.

Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attacker to crash the device by submitting a malformed request to the setPasswordCfg function in the CGI-based web management interface. Exploitation triggers a null pointer dereference in /cgi-bin/cstecgi.cgi, rendering the device unresponsive and disrupting its network extension services entirely. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation, though no active exploitation has been recorded in CISA KEV at time of analysis.

Null pointer dereference in HarmonyOS 6.1.0's image codec module allows a local, unprivileged process to crash the codec and degrade device availability. Huawei disclosed this via their August 2026 security bulletins covering consumer devices, vision products, wearables, and laptops running HarmonyOS. No active exploitation has been identified (SSVC: Exploitation none), and the impact is bounded to partial availability loss with no confidentiality or integrity exposure.

Null pointer dereference in the HarmonyOS image codec module causes a local denial-of-service condition, degrading availability of affected devices running HarmonyOS 6.1.0. The flaw is triggered locally without requiring elevated privileges, and successful exploitation crashes or hangs the image codec process. No active exploitation has been identified; no public exploit code is known at time of analysis.

Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticated remote attackers to crash the internal load balancer process by sending a single crafted packet. Exploitation is constrained to deployments with load balancing enabled; critically, the Secure Access server itself remains operational after the attack, continues to accept client connections, and retains the ability to failover - limiting real-world impact to partial load-distribution disruption rather than full service outage. No public exploit code has been identified and no confirmed active exploitation is recorded at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic: | Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected. This has been broken since bpf_redirect() was introduced for TC in commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky for a long time because bpf_net_context was a per-CPU variable that was always available. commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") turned bpf_net_context into a task_struct member that is only set up by explicit callers. Without a caller setting it up, bpf_redirect() itself crashes with a NULL pointer dereference in bpf_net_ctx_get_ri(). However, even with bpf_net_context available, TC_ACT_REDIRECT from qdisc filter chains cannot be honored without adding skb_do_redirect() calls to every qdisc classify function, which would require changes across net/sched/. Isolate it to ebpf core where it belongs. Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a wrapper around tcf_classify() for use by qdisc classify functions and tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT, the wrapper converts it to TC_ACT_SHOT, dropping the packet rather than letting it continue silently. Dropping is preferred over letting the packet through because the user immediately sees packet loss. Silently passing the packet through would hide the problem and leave the user wondering why their redirect is not working. The clsact fast path, tc_run() continues to call tcf_classify() directly and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by sch_handle_egress/ingress() calling skb_do_redirect() as before.

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it.

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change. dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, so the page allocator warns and returns NULL. dc_create() then fails, DM init fails and amdgpu probe aborts with -EINVAL: WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660 [amdgpu] amdgpu_dm_init+0x2d9/0x510 [amdgpu] dm_hw_init+0x1b/0x90 [amdgpu] amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu] amdgpu_driver_load_kms+0x19/0x80 [amdgpu] amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] dc_create() then returns NULL and DM init fails, which aborts the whole GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block <dm> failed -22"), leaving the display unusable. The subsequent amdgpu_irq_put() warnings during teardown are just fallout of unwinding a half-initialized device. struct dc is a software-only bookkeeping structure that is never handed to hardware DMA and is only ever kept as an opaque pointer, so it does not require physically contiguous memory. Allocate it with kvzalloc() (and free it with kvfree()) so that the allocator can fall back to vmalloc() when a contiguous allocation of that size is not available, which also avoids the MAX_PAGE_ORDER warning entirely. v2: - Rebase to amd-staging-drm-next. (cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replaced the dnv_board setup and exit callbacks with PTR_IF(false, ...), which evaluates to NULL. However, the three call sites in mid8250_probe() and mid8250_remove() unconditionally dereference these function pointers without NULL checks, causing a NULL pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), or Snowridge (SNR) platform. Fix this by adding the missing NULL checks before calling the setup and exit callbacks.

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.

MongoDB Server's query planner contains a null pointer dereference (CWE-476) that enables any authenticated user holding read-level privileges to crash the server process by submitting a specially crafted query against a collection with a text index. Affected branches span MongoDB 7.0.x, 8.0.x, and 8.3.x, with fixed releases available in 7.0.40, 8.0.29, and 8.3.8 respectively. No public exploit or active exploitation is identified; SSVC rates exploitation as none and the attack is not automatable, though the availability impact is total for the targeted server instance.

Windows iSCSI Target Service across multiple Windows Server and Windows 10 versions contains a null pointer dereference that enables an unauthenticated remote attacker to crash the service, resulting in denial of service. Affected systems span Windows Server 2016 through 2025 and Windows 10 versions 1607 and 1809, all below their respective patched build numbers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated network vector makes it straightforward to exploit once the target service is reachable.

Remote denial-of-service in the Windows Graphics Kernel allows unauthenticated network attackers to crash affected systems by triggering a null pointer dereference in kernel mode, impacting availability across Windows 10, Windows 11, and Windows Server 2022/2025. The CVSS Scope:Changed flag indicates the resulting crash propagates beyond the Graphics Kernel subsystem itself, consistent with a full system halt (BSOD). No public exploit has been identified at time of analysis, and Microsoft has released patches establishing fixed build numbers for all confirmed affected versions.

Remote Registry Service denial of service in Microsoft Windows allows network-authenticated attackers to crash the service via a crafted RPC request triggering a null pointer dereference. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that any domain or local account with network access to the service is sufficient for exploitation - no elevated privileges required. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Null pointer dereference in the Windows Remote Registry Service enables an authenticated network attacker to crash the service, resulting in denial of availability for remote registry operations across a broad range of Microsoft platforms. Affected builds span Windows 10/11 consumer releases and Windows Server 2012 through Server 2025, representing the near-entirety of Microsoft's currently supported Windows footprint. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, positioning this as a standard patch-cycle priority rather than an out-of-band emergency.

Null pointer dereference in the Windows TCP/IP kernel driver exposes virtually every supported Windows Server and desktop release to remote denial-of-service attacks without any authentication or user interaction. The flaw, rooted in CWE-476, causes a kernel panic (Blue Screen of Death) when a specially crafted network packet triggers a NULL pointer dereference in tcpip.sys, crashing the affected host. Nineteen distinct product/version combinations from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2 are confirmed affected; no public exploit has been identified at time of analysis, and Microsoft has released corrective patches.

Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.

Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.

Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.

Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.

NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.

NULL pointer dereference in the shim application's dp.c library exposes Red Hat Enterprise Linux 7, 8, and 9 systems using UEFI Secure Boot to a local denial-of-service condition. An attacker with high local privileges and the ability to interact with the shim boot path can trigger the missing NULL pointer check, potentially disrupting the boot process. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.9 reflects the constrained attack prerequisites, though the changed scope (S:C) signals that the impact crosses from the shim component into the broader boot environment.

Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.

Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the entire Trusted Execution Environment by opening a session directly on the Widevine pseudo-TA when CFG_WIDEVINE_PTA is enabled. The open_session handler in core/pta/widevine.c calls is_user_ta_ctx(session->ctx) without first checking that session is non-NULL, faulting the TEE at S-EL1 and making all TEE services - including secure key storage and other Trusted Applications - unavailable until reboot. No public exploit code exists and no CISA KEV listing is present; the upstream fix is confirmed by commit 0aadfc2 and the CVSS 4.0 score of 5.7 reflects the local, low-privilege, configuration-dependent exploitation conditions.

NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.

NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.

Unauthenticated remote crash in Klever-Go versions 1.7.14-1.7.17 allows any network peer to terminate a node process by gossiping a 3-byte protobuf Transaction with the RawData sub-message omitted, triggering a nil-pointer dereference in the synchronous P2P validation callback with no panic recovery. No account, stake, validator key, or funds are required - the attacker only needs network reachability to the libp2p gossip port. Repeated delivery targeting enough BLS validators can halt block production entirely, constituting a chain-halt attack against the Klever network. No public exploit code or CISA KEV listing was identified, but the trivial payload and zero-prerequisite nature of exploitation make this a high-urgency upgrade target.

Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a network attacker holding config-entry write permission to crash the Consul server agent by submitting a crafted service-router configuration entry. The flaw is rooted in a null pointer dereference (CWE-476) triggered along the Enterprise-to-Community Edition downgrade code path, meaning only deployments undergoing or having undergone that transition are exploitable. No public exploit code or active exploitation confirmed by CISA KEV has been identified; vendor-released patches are available and confirmed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Kernel null pointer dereference in Imagination Technologies Graphics DDK allows a local non-privileged user to crash the host system via crafted GPU system calls. Multiple release branches are affected, including DDK 26.1 RTM1, 25.1-25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. An attacker with a local shell account on a device running the affected kernel driver can trigger platform instability or a full denial of service - no exploit has been publicly identified at time of analysis, and EPSS probability is extremely low at 0.15% (5th percentile).

Null pointer dereference in the llama.cpp LLaMA-Android JNI wrapper's bench_1model() function allows denial of service via a crafted model file. Builds b1886 through b7445 (packaged releases 0.9.0-0.17.1) are affected; the function skips null validation on the model context pointer before dereferencing it, so supplying a malformed or truncated GGUF model file triggers a SIGSEGV that terminates the Android application process. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the attack path is mechanically simple for anyone able to deliver a crafted model to the device.

Null pointer dereference in HDF5 through 2.3.0 allows denial of service when a user opens a crafted file containing a malformed N-Bit filter pipeline message with zero client-data values. The function H5Z__filter_nbit unconditionally reads cd_values[0] through cd_values[4] before checking whether the array is non-NULL or contains at least 5 elements, crashing any application - including the bundled h5ls and h5repack tools - that calls H5Dread on such a dataset. No active exploitation has been confirmed (not listed in CISA KEV) and no EPSS score was available, but the fix diff publicly exposes the exact crash path, lowering the barrier for proof-of-concept development.

NULL pointer dereference in HDF5's H5Pget_fill_value function (all versions before 2.1.1) enables denial of service by processing a specially crafted HDF5 dataset file. The flaw arises when a fill value message (format version 1 or 2) carries the 'defined' flag alongside a negative size field - a malformed state the library fails to normalize to its internal 'undefined' sentinel - allowing a NULL datatype pointer to reach H5T_path_find and crash the process. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.2 reflects high availability impact, but the local file-parsing vector and user interaction requirement meaningfully constrain real-world exposure.

Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.

Denial of service in OpenSIPS SIP server versions prior to 3.6.6 allows an unauthenticated remote attacker to crash worker processes by sending a SIP request containing a malformed SDP bandwidth line that omits the required colon delimiter. The crafted payload triggers a null pointer dereference (CWE-476) in the SDP parsing layer; when dialog or QoS modules subsequently clone the corrupted SDP state, the worker process terminates abnormally. No active exploitation is confirmed at time of analysis, though publicly readable patch commits expose the exact byte-level trigger, significantly lowering the barrier to exploit construction.

Denial of service in OpenSIPS versions 3.4.0 through 3.6.5 and 4.0.0-beta allows remote attackers to crash the server with a single crafted SIP PUBLISH request targeting the presence module. The crash stems from a NULL pointer dereference in handle_publish() triggered when enable_sphere_check=1 is configured: get_content_type() is invoked without first calling parse_content_type_hdr(), leaving Content-Type parsing state uninitialized and producing a segmentation fault via either a NULL parsed sub-pointer or a NULL content_type pointer. No public exploit has been identified at time of analysis, but the attack mechanics are fully described in the vendor advisory (GHSA-h3ww-hchh-x2g9), and the fix is available in 3.6.6 and 4.0.0-rc1.

Client process termination in FreeRDP before 3.29.0 is achievable by remote unauthenticated attackers through crafted smartcard cache requests. The flaw resides in the NDR (Network Data Representation) decoder for SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations, which accept NULL for the LookupName pointer; when strlen() is subsequently called on that null pointer, the client process crashes. Exploitation requires smartcard emulation to be enabled on the FreeRDP client. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-reachable, zero-prerequisite nature of the crash path makes this a credible DoS risk wherever the feature is deployed.

Null pointer dereference in FreeRDP's smartcard virtual channel allows remote unauthenticated attackers to crash the process by sending malformed smartcard IRP (I/O Request Packet) requests. All FreeRDP releases before 3.29.0 are affected: crafting an IRP with a non-zero cReaders field but truncated reader-state payload causes the decoder to fail, after which the free_reader_states cleanup function dereferences a null pointer and terminates the session. Impact is limited to denial of service - no confidentiality or integrity compromise is possible. No public exploit code or CISA KEV listing identified at time of analysis.

Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data.

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.

Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.

Denial of service via null dereference in Let's Chat 0.4.0 through 0.4.8 allows authenticated users to crash the server by sending a crafted request with a non-existent room ID. The vulnerability is remotely exploitable with no user interaction, and publicly available proof-of-concept code exists. No evidence of active exploitation or CISA KEV inclusion was identified at the time of analysis.

Denial of service in GitHub MCP Server versions below 1.1.0 allows any unauthenticated attacker to crash the server by sending a malformed completion/complete JSON-RPC request with missing parameters. The nil pointer dereference occurs before authentication checks, making exploitation trivial. Publicly available exploit code exists, enabling immediate termination of the process.

Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.

Null pointer dereference in the Linux kernel module decompression path crashes the kernel when a local user loads a compressed module under memory pressure. The flaw exists across multiple stable kernel branches and was introduced at commit b1ae6dc41eaa; patches are now available for all affected stable trees. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.21% (12th percentile) reflects very low exploitation probability, consistent with the local-only, condition-dependent attack surface.

NULL pointer dereference in the Linux kernel's `page_ext` memory iteration API crashes systems during dynamic memory hotplug operations. The `page_ext_iter_next()` function fails to enforce the PFN boundary, advancing the iterator index past `__pgcount` and calling `page_ext_lookup()` on an uninitialized memory section, triggering a kernel panic. With EPSS at 0.21% (11th percentile) and no CISA KEV listing, real-world exploitation is low-probability and operationally constrained to environments actively performing memory hotplug, such as cloud hypervisors or NUMA-heavy servers with memory ballooning.

Null pointer dereference in the Linux kernel's KVM arm64 nested virtualization subsystem allows a local low-privileged attacker to crash the host kernel via a race condition in VNCR pseudo-TLB invalidation. The function kvm_invalidate_vncr_va() dereferences the VNCR pseudo-TLB pointer without first verifying allocation or validity, unlike its companion kvm_invalidate_vncr_ipa(). Exploitation results in a kernel panic that disrupts all virtual machines on the affected host; no public exploit has been identified at time of analysis, and EPSS of 0.21% (11th percentile) reflects minimal observed exploitation activity.

NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.

NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.

NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.

Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.

Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.

NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).

NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.