Null Pointer Dereference

Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.

Denial of service in pupnp (portable UPnP SDK) versions prior to 2.0.2 affects remote, unauthenticated deployments whose applications parse attacker-controlled XML and invoke ixmlElement_removeAttributeNode, causing the process to crash when ixmlNode_compare passes NULL nodeValue, namespaceURI, prefix, or localName fields to strcmp. The NULL fields arise legitimately from non-namespaced attributes created by ixmlDocument_createAttribute, and the crash occurs only when find_condition_node compares two distinct attribute objects with the same nodeName so the pointer-identity shortcut does not apply. No public exploit code or active exploitation was identified at time of analysis, and the vendor fixed the issue in 2.0.2 via commit 4b2f775e; impact is limited to availability (CWE-476, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure.

Nil-pointer dereference in kin-openapi 0.136.0 through 0.148.x lets an unauthenticated remote client reliably panic Go applications that run openapi3filter request validation against an OpenAPI 3.1 spec declaring an array schema without an items definition. Three decoder paths are affected: a plain array query parameter, a deepObject query parameter whose object contains an array property, and an application/x-www-form-urlencoded body whose array property appears inside an allOf, anyOf, or oneOf subschema - each passes a nil items schema into urlValuesDecoder.parseArray or buildResObj, which dereferences it. Impact is availability-only (CVSS 7.5, CWE-476), exploitation is conditional on the target application actually exposing such a nil-items array schema on a validated route, and no public exploit code or CISA KEV entry is identified at time of analysis; the vendor fixed the issue in 0.149.0.

Response validation in kin-openapi (openapi3filter.ValidateResponse) panics with a nil pointer dereference when an OpenAPI 3.x document declares a response header using a 'content' media-type object instead of a 'schema' field - the document itself validates successfully, but every response validation for the affected operation dereferences the nil schema and crashes, even when the response omits the declared header entirely. All versions prior to 0.146.0 are affected, and the flaw is unauthenticated and network-reachable (CVSS 4.0 AV:N/PR:N), though the decisive qualifier is AT:P: remote availability impact realistically applies only to applications that ingest untrusted or third-party specifications, while applications using only trusted local specs suffer a self-inflicted crash when the affected operation is exercised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the upstream commit adds a regression test and a nil-schema guard in the decoder. EPSS data was not provided for this CVE.

Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.

Null pointer dereference in the FreeRDP client's rdpsnd (audio redirection) channel allows a malicious or compromised RDP server to crash any connecting client running FreeRDP 3.0.0 through 3.31.x, producing a denial of service that terminates the user's RDP session. The trigger is a malformed rdpsnd fragment that sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST and arrives on a fresh channel; the CVSS vectors (4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VA:H, and the assessed 3.1 equivalent AV:N/AC:L/PR:N/UI:R/A:H) confirm unauthenticated remote reach but strictly availability-only impact - no confidentiality, integrity, or code-execution effect. Exploitation requires the victim to initiate a session against the attacker's server and to have audio redirection negotiated; there is no evidence of in-the-wild exploitation and no public exploit identified at time of analysis.

A crafted VPN-flowspec BGP update can crash the routing protocol daemon (rpd) on Juniper Junos OS and Junos OS Evolved, causing a denial of service, but only when that update is readvertised by the device and BMP post-policy RIB-out monitoring is explicitly configured. The flaw is a NULL pointer dereference (CWE-476) reachable by a remote BGP peer that already has an established peering session with the target (PR:N means no device-level authentication is required, but a configured neighbor relationship is a practical prerequisite). The vendor rates it 8.7 under CVSS 4.0 while our independent assessment scores it 7.5 under CVSS 3.1 (AC:H), reflecting the non-default BMP configuration and readvertisement conditions; impact is availability-only with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.

A specific BGP packet sent by an existing eBGP peer can trigger a NULL pointer dereference in the routing-policy nexthop-ECMP matcher of Juniper Junos OS and Junos OS Evolved, killing the routing daemon and causing a denial of service (CVSS 4.0 base 8.7; independent assessment scores it AV:N/AC:H/PR:N/UI:N/A:H with no confidentiality or integrity impact). Exploitation is gated by two preconditions: the device must have a nexthop-ecmp qualifier attached to a BGP import policy - an explicitly deployed, non-default routing-policy configuration - and the sender must already be a configured eBGP peer, so an arbitrary unauthenticated Internet host cannot reach the flaw; the CVSS vectors carry PR:N, but reachability still requires an established BGP peering session. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available per Juniper advisory JSA112187.

Unauthenticated adjacent attackers can crash the routing protocol daemon (rpd) on Juniper MX Series devices running Junos OS and ACX Series devices running Junos OS Evolved by sending a malformed IGMPv3 membership report over a directly connected network, producing a denial of service. The defect is a NULL pointer dereference (CWE-476) reached while the device processes IGMPv3 membership traffic, so exploitation requires multicast/IGMP to be configured and active on the receiving interface, and it does not yield any confidentiality or integrity impact. Vendor-reported CVSS 4.0 base score is 7.1 (AV:A, PR:N, UI:N, VA:H), and there is no public exploit identified at time of analysis; a vendor patch is available per Juniper advisory JSA112187 (EUVD-2026-101386).

Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.

A malformed RSVP Path message sent over an EVPL LMP control channel can dereference a NULL pointer in the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd), crashing the process and causing a denial of service. Network-adjacent attackers with Layer 2 reachability to the control channel can trigger the crash without authentication or user interaction, though only devices explicitly configured for EVPL service with an LMP control channel are exposed - a non-default configuration. No public exploit has been identified at time of analysis, and the independent assessment characterizes this as a moderate-severity, targeted availability issue rather than a top-tier emergency.

A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved crashes the daemon and causes a denial of service when a routing policy that uses AS-path expansion is evaluated against MSDP or PIM data. Exploitation is constrained by non-default configuration: the device must have MSDP or PIM enabled together with an AS-path-expansion policy, and the attacker must either already be a configured MSDP peer or be an adjacent PIM sender able to inject PIM messages. Juniper rates the 4.0 base score at 8.7 with network reach, low complexity, and PR:N per the vector, but the real limiting factors are positional (established peering or adjacency) and configuration-specific rather than arbitrary-internet reachable; impact is availability only, with no data exposure, integrity loss, or code execution, and no public exploit identified at time of analysis.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved arises when the routing protocol daemon (rpd) dereferences a NULL pointer while processing multiple BGP UPDATE messages delivered over a single TCP session, but only with the non-default 'bgp family l2vpn auto-discovery-only' BGP family configured. A remote BGP peer can crash rpd and interrupt routing services on the affected device; the daemon recovers, and there is no confidentiality or integrity impact. Exploitation requires an already-established, configured BGP adjacency rather than arbitrary internet access, and no public exploit code or confirmed active exploitation was identified at time of analysis.

A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.

A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker positioned on an adjacent Layer 2 segment or as a multicast/routing peer to crash the routing protocol process by sending a malformed PIM Bidirectional (Bidir) message, producing a denial-of-service condition (CVSS 7.1). Exposure is gated by configuration: the target device must be running PIM Bidir, a non-default multicast feature, which means only networks actively deploying bidirectional PIM are at risk, and the attacker must be able to deliver a PIM packet directly to rpd rather than across arbitrary routed networks. Impact is confined to availability of the routing control plane - no code execution, data disclosure, or configuration integrity impact - and there is no public exploit identified at time of analysis.

Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.

A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.

A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.

Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.

Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.

A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.

Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.

A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.

Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.

Local privilege escalation in the Windows MIDI Service Module allows an attacker holding low-privileged local access on an affected Windows 11 host to trigger a null pointer dereference (CWE-476) and escalate to a higher-integrity security context, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access (PR:L) and a non-deterministic, likely race- or timing-dependent trigger (AV:L/AC:H/UI:N), which materially reduces real-world reliability; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none. With a 7.0 base score and total technical impact if successfully triggered, this is best treated as a moderate-priority local elevation-of-privilege flaw to be closed on the normal patch cycle rather than an urgent internet-facing emergency.

Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.

Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.

Denial of service in Windows DHCP Server allows unauthenticated remote attackers to crash the DHCP service via a null pointer dereference. Exploitation requires the DHCP Server role to be installed and running on affected builds of Windows Server 2012 through 2025 (including Server Core installations) and Windows 10 1607/1809, with the attacker able to reach the service over the network through UDP 67/68 or the RPC management interface. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the impact is availability-only with no confidentiality or integrity loss.

Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.

Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.

Null pointer dereference in MongoDB Server's collection validation feature enables an authenticated user with write access to crash the mongod process, producing a denial-of-service condition. The attacker must be able to create or modify a collection validator (for example via create or collMod with a validator document containing the mishandled expression); the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Impact is limited to availability - no confidentiality or integrity loss - and the issue is most exploitable in shared or multi-tenant deployments where write and schema-validation privileges are broadly granted; no public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a widespread emergency.

A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.

Unauthenticated remote attackers can crash yt-dlp-web-ui 4.0.0 and earlier by sending a single JSON-RPC request to the default Service.Formats method, where a crafted url value such as '--version' is passed to the underlying yt-dlp process and produces unexpected output that fails JSON parsing, leading to a NULL pointer dereference and an unrecovered panic that terminates the server process. No credentials, user interaction, or special configuration are required - the only precondition is network reachability of the JSON-RPC interface - and publicly available exploit code exists, so any instance bound to a routable interface or exposed through a reverse proxy is trivially and repeatedly deniable. The impact is confined to availability: there is no data exposure, integrity loss, or code execution.

NULL pointer dereference in FreeRDP's Remote Desktop Gateway (RDG) transport path affects client builds from 2.3.0 up to (but not including) 3.32.0, allowing an attacker who controls or has compromised the RD Gateway to crash a connecting client. The malicious gateway only needs to return an eight-byte, header-only PKT_TYPE_CLOSE_CHANNEL control packet; rdg_process_control_packet forwards the absent payload to rdg_process_close_packet without a NULL check, and the client dereferences it. The attacker must already occupy the gateway position (not an arbitrary remote host) and the user must initiate the outbound RDP session, so this is a bounded, availability-only denial of service - CVSS v4.0 base 7.1, with the independent assessment scoring it AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the gateway-position prerequisite constrains realistic abuse.

FreeRDP clients running versions 3.27.1 through 3.31.x with the non-default Bitmap Cache V3 feature enabled can be crashed by a malicious or compromised RDP server that sends a crafted Cache Bitmap V3 order during connection setup. The NULL pointer dereference occurs because the client bitmap cache is accessed before it is initialized when the CBR3_DO_NOT_CACHE flag is set, leading to a denial-of-service (availability impact only, no confidentiality or integrity loss). Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server and have enabled the Bitmap Cache V3 codec via /cache:codec:<rfx|nsc|jpeg>; default configurations are not affected, and no public exploit code has been identified at time of analysis.

Denial of service in mp4v2 2.0.0 lets a remote, unauthenticated attacker crash any process that parses an attacker-supplied MP4 file, because MP4File::GenerateTracks() in src/mp4file.cpp passes a NULL handler-type string straight into strcmp() without a check (CWE-476). Impact is availability-only - no code execution, privilege escalation, or data exposure - but the defect is trivially automatable (CISA SSVC: automatable yes, technical impact partial) and publicly available exploit code exists, with no CISA KEV designation. EPSS and NVD enrichment were not provided in the available data, so no quantitative exploit-likelihood score is asserted here. In server-side pipelines that ingest untrusted MP4s the exposure is genuinely remote and unauthenticated; for interactive clients it reduces to a user opening a malicious file.

Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.

Unauthenticated remote attackers can crash IBM DataPower Gateway by sending a crafted request that triggers a null pointer dereference, resulting in a denial of service that takes the affected service interface offline. All four maintained release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or privileged position is needed - only network reachability to a vulnerable, unpatched gateway - and the sole impact is availability (C:N/I:N/A:H), with no data exposure or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but bounded availability risk that is governed primarily by how exposed the gateway's service interfaces are to untrusted networks.

Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that calls File.GetSlicers. When a worksheet contains an extLst element but the independently optional drawing element is absent, GetSlicers dereferences the nil ws.Drawing pointer while resolving the drawing relationship, producing a runtime panic; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) indicates remote, unauthenticated triggering with high availability impact but no confidentiality, integrity, or scope impact. Exploitation is not confirmed to be occurring in real-world campaigns and no public exploit code has been identified at time of analysis, though the upstream fix commit and pull request are public, which lowers the bar for crafting a malicious XLSX; the independent assessment rates this as a moderate, impact-limited risk because GetSlicers is not part of the default file-open or parse path and any recover() wrapper neutralizes the crash.

Crafted HTTP requests sent by an unauthenticated wireless client associated to a captive-portal-enabled SSID can crash the Captive Portal service on affected Arista Wi-Fi access points, and a sustained low-rate flood of such requests can keep the portal persistently unavailable (CVSS 7.1, availability-only, no confidentiality or integrity impact and no remote code execution). Exploitation is limited to the wireless adjacency: the attacker must be within RF range and associated to a captive-portal SSID, and access points without Captive Portal configured are not exposed. Because the portal process restarts automatically after each crash, a single request is self-healing; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.

Denial of service in Moby BuildKit allows a low-privileged remote user to crash the BuildKit daemon by submitting a build that attempts to use a CDI device when the daemon was started with the --cdi-disabled flag. This triggers a null pointer dereference (CWE-476) and daemon panic. The vulnerability requires a non-default configuration and the ability to submit builds; default deployments are not affected. No public exploit has been identified, and the vendor has released a patch in version 0.33.1.

Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.

Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.

NULL pointer dereference in RT-Labs AB C-Open (CANopen protocol stack, all versions before 1.1.1) lets an unauthenticated attacker who already has access to the CAN bus crash an affected device by starting the LSS (Layer Setting Services) protocol against a node whose user application defined identity object 0x1018 without all of its required subindexes. Impact is availability-only (CVSS 4.0 base 7.1; independently assessed as CVSS 3.1 AV:A/AC:L/PR:N/UI:N/A:H), meaning a device reset/denial of service rather than data disclosure or code execution, and exploitation is bounded by three prerequisites: bus-local (adjacent) access - reachable, for example, through a compromised node, not from the internet - a misconfigured, non-default identity object, and the ability to send LSS frames. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (not in CISA KEV). Fixed in C-Open 1.1.1, the same release that also addresses CVE-2026-82358.

Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.

Denial of service in Apache HTTP Server releases before 2.4.69, where the mod_xml2enc filter dereferences a NULL pointer when a proxied response declares a charset whose conversion partially succeeds and then fails, crashing the handling child process. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the crash is reachable without credentials over the network, but exploitation is gated by a trust boundary: the request path must run proxied backend responses through mod_xml2enc (in practice mod_proxy_html content rewriting), and the attacker must control or have compromised that upstream backend server - ordinary external clients cannot directly trigger it. Impact is limited to availability (worker/child process termination with no confidentiality or integrity effect), and no public exploit code, KEV listing, or EPSS score was provided at time of analysis, so this is best treated as a low-to-moderate priority hardening item for reverse-proxy deployments that transform untrusted upstream content.

Apache HTTP Server 2.4.0 through 2.4.68 can be crashed by a remote unauthenticated attacker via a NULL pointer dereference in the mod_heartmonitor module when it is configured with a unicast listener. The module is non-default, limiting exposure to specific deployments; no public exploit code or active exploitation has been identified, though the attack is automatable per CISA SSVC. The impact is limited to denial of service (availability), with no confidentiality or integrity loss.

A NULL pointer dereference in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows a locally present, low-privileged authenticated user to crash the driver - and potentially the kernel - by supplying a crafted request to the kernel-mode driver layer (for example via device ioctls). Affected platforms span the GeForce, RTX/Quadro/NVS, and Tesla driver lines on Linux, and the 'Guest Driver' / 'Virtual GPU Manager' tags indicate the vGPU path is also in scope, so a guest session inside a virtualized vGPU deployment is a valid attack position. The vendor claims the flaw 'might' lead to code execution, privilege escalation, information disclosure, and data tampering, but the reliably achievable outcome is a denial-of-service crash; there is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis.

NULL pointer dereference in Pgpool-II allows an unauthenticated remote attacker to crash the watchdog process when the high-availability clustering feature is enabled and network-reachable. This is an availability-only impact (no confidentiality or integrity loss) and is limited to HA deployments where watchdog is configured; single-node or non-HA installations are unaffected. No public exploit identified at time of analysis, and the vendor has not yet released a patch.

Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management daemon, producing a denial of service on affected Firebox appliances. The root cause is a NULL pointer dereference (CWE-476) triggered by a specially crafted request to the login endpoint; impact is confined to availability of the management daemon, with no confidentiality or integrity loss and no code execution. Exploitation requires only network reachability to the management/authentication interface (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis (the CVE is not listed in CISA KEV). The published score of 8.7 reflects the CVSS 4.0 vector, while the independent assessment treats this as a genuine but bounded availability risk whose real-world severity hinges on how widely the login interface is exposed.

Denial of service in WatchGuard Fireware OS lets remote, unauthenticated attackers crash the appliance by delivering a specially crafted IPv6 packet into its NetFlow packet-processing path, triggering a NULL pointer dereference (CWE-476). The flaw is availability-only (vendor CVSS 4.0 base 8.2, with VA:H and no confidentiality or integrity impact) and requires that NetFlow processing is actually configured and reachable over IPv6, so exposure is limited to deployments that enable that feature rather than to every Firebox. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS signal was supplied; the practical risk is a repeatable remote crash of a perimeter device, which is still serious because a reboot or failover is required to restore service.

Crashes of PX4 Autopilot flight controllers (versions through 1.17.0) can be induced by invoking the sd_stress diagnostic system command with a -b byte count outside the documented 1-10000 range, because that value is passed unchecked into malloc() and memset() and ends up dereferencing a NULL pointer. The command shell is reachable from the adjacent MAVLink telemetry/command link (AV:A with PR:N per the CVSS vector, though practically the attacker must be able to reach that interface and run system commands), so the result is an availability-only denial of service with no code execution or data disclosure. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at the time of analysis; the independent assessment rates this as a moderate-severity availability issue rather than a high-impact priority, and deployments that authenticate or restrict the MAVLink shell or remove sd_stress from production firmware are not exposed.

Pushing a zero-length NAL unit into libde265's de265_push_NAL() API leaves a NAL_unit with a NULL backing buffer that is then handed to memcpy() as the destination in NAL_unit::set_data(); although the copy length is zero, the call violates memcpy()'s nonnull contract and, in UBSan-instrumented or hardened builds, terminates the process, while standard production builds typically survive the call but abort decoding of the affected stream. The issue affects libde265 through the vulnerable snapshot 4d45a6b and any downstream consumer that decodes untrusted HEVC/H.265 data, including software using libheif for HEIF/HEIC handling; it is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), though a victim must actually decode the malicious media. Exploitation status is low-risk: there is no CISA KEV listing and no public exploit identified at time of analysis, EPSS is only 0.15% (4th percentile), and this analyst assessment rates the availability impact as Low rather than the High implied by the published 7.5 score, so the 7.5 overstates real-world impact for typical deployments.

Unauthenticated remote attackers can crash PgBouncer through 1.25.2 by sending a malformed SCRAM client-final-message that triggers a NULL pointer dereference. The crash occurs before credential verification and terminates all pooled connections because PgBouncer uses a single process. No public exploit identified at time of analysis; exploitation requires PgBouncer configured with SCRAM authentication (auth_type=scram-sha-256) and network access to the listener port.

Malformed 3G/UMTS RRC signalling messages delivered to the ASR Crane/Falcon cellular baseband trigger a NULL pointer dereference in the as_rrc module (file 3g.mod/lib/src/urrsir.c), crashing the modem and denying cellular service to the affected device. ASR's self-assigned CVSS 3.1 score is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), whereas independent assessment rates it AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a radio-proximity availability attack against 3G-capable ASR modem platforms, with no demonstrated code execution or data compromise. Exploitation requires the victim handset to be camped on or processing signalling from a hostile 3G cell (rogue base station or air-interface man-in-the-middle), and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV and the sole reference is the vendor PSIRT advisory.

Denial of service in Open5GS up to and including 2.8.0: a crafted PFCP message that declares a Volume Measurement information element shorter than the fields the parser actually reads causes a null pointer dereference in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, aborting the affected SMF/UPF process and disrupting the 5G core user-plane control path. The attack is launched remotely by sending malformed PFCP signaling to the N4 interface, which in a correctly segmented deployment is an internal control-plane segment rather than an internet-facing service; the vendor's CVSS 4.0 vector scores it 7.1 with PR:L, while our independent assessment scores 7.5 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, availability-only impact) because Open5GS's PFCP implementation does not enforce authentication. An upstream fix commit (8f07b507b78ff94776f2cd49276eb116ed93d7f2) is published, and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a pure availability impact with no credentials or user interaction required; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the vendor has released a fix.

Unauthenticated remote attackers can abort the `named` process in BIND 9 by sending a crafted DNS-over-HTTPS request that carries a cryptographically invalid SIG(0) record and then prematurely closing the transport connection, producing a null pointer dereference (CWE-476) that terminates the server. Affected versions are 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the 9.20.9-S1 through 9.20.27-S1 subscription branch; the assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning no authentication or user interaction and availability-only impact. Exploitation requires the targeted named instance to have the DoH transport enabled and to process SIG(0)-signed messages, so server deployments without DoH exposed to the attacker have no reachable attack surface; impact is limited to a process abort with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (9.20.29 and 9.21.26).

Denial of service in Monkey HTTP Server (all builds through commit 4fb0c16) allows a remote, unauthenticated attacker to crash the server by sending a single crafted HTTP request that drives the scheduler into a NULL pointer dereference in mk_sched_event_close() (mk_server/mk_scheduler.c). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is availability-only: no confidentiality or integrity loss, no code execution, and no privileges, user interaction, or non-default configuration required - only that the server is listening on an attacker-reachable interface. EPSS is low at 0.51% (43rd percentile) and there is no CISA KEV listing, so no public exploit code has been identified at the time of analysis; the practical risk is repeated process crashes against exposed deployments rather than mass exploitation.

FreeRDP clients before 3.31.0 crash when a malicious RDP server sends a crafted Surface Bits command advertising the NSCodec codec ID — the GDI surface-bits handler dereferences a NULL decoder pointer instead of rejecting the unsupported codec. The victim only has to initiate an RDP session to an attacker-controlled or compromised server; the outcome is a client-side denial of service (application crash), with no memory corruption, code execution, or data exposure reported. No public exploit code and no CISA KEV listing were identified at time of analysis.

Content spoofing caused by an invalid-pointer (null-pointer dereference) condition in Mozilla Firefox's Graphics rendering component affects Firefox versions prior to 156, allowing a remote, unauthenticated attacker to falsify or distort what a victim sees when the browser renders attacker-supplied web or graphics content. Mozilla shipped the fix in Firefox 156 (advisories MFSA2026-90 and MFSA2026-94, Bugzilla 2061393); there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low at roughly 0.14% (4th percentile). The raw CVSS 9.1 score overstates practical risk - our independent assessment lowers it to AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L because exploitation requires the victim to navigate to and render malicious content, and the realistic outcome is spoofing plus a limited crash/denial-of-service condition rather than full integrity or availability loss.

Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.

NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.

Remote code execution in Microsoft Office Word allows an unauthenticated network attacker to execute arbitrary code on a victim's machine by delivering a specially crafted document that triggers a null pointer dereference. Affected versions span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and Office LTSC for Mac variants. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.

Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.

Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.

Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.

Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.

Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.

Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Unauthenticated remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13) allows a network attacker to crash the LDAP server by sending a crafted sequence of search requests that combine the paged results control with the USE_ONE_BACKEND control, triggering a NULL pointer dereference in `op_shared_search`. The crash terminates the directory service process, disrupting all LDAP-dependent services such as authentication, authorization, and group resolution until manually restarted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector makes automated, repeated disruption straightforward.

Denial of service via NULL-pointer dereference in strongSwan's x509 plugin affects versions 4.2.0 through 6.0.x, triggered during verification of X.509 attribute certificates. An unauthenticated remote attacker can crash the charon IKE daemon by presenting a crafted attribute certificate during VPN handshake negotiation, taking the gateway offline. Vendor-released fix is strongSwan 6.1.0, published September 7, 2026, as part of a coordinated batch of six CVE patches; no public exploit has been identified at time of analysis.

Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.

Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.

Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.

NULL pointer dereference in GStreamer's RTSP support library (gst-plugins-base) crashes any process that parses a Digest authentication header containing specially crafted whitespace, resulting in a denial-of-service condition. The flaw is bidirectional: an unauthenticated remote attacker can crash an RTSP server by sending a single malformed request when Digest authentication is enabled, and a malicious or compromised RTSP server can crash an RTSP client using the same technique. No confidentiality or integrity impact is confirmed; the sole consequence is process termination. No public exploit code or CISA KEV listing has been identified at time of analysis.

NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.

Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.

Null pointer dereference in ccoap's coap_dump_msg() function causes remote denial of service when processing CoAP messages that carry options with zero-length values. The flaw is pinned to commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap library. An unauthenticated remote attacker reachable by the CoAP service can crash any process that links this library by sending a single crafted packet. No public exploit has been identified at time of analysis, and EPSS is 0.15% (5th percentile), reflecting low real-world exploitation activity.

Null pointer dereference in ccoap's CoAP server (commit 77f55c4b) allows unauthenticated remote attackers to crash the server process by sending a crafted CoAP message. The vulnerability exists in coap_server_handle_session(), which calls strncmp() on a URI_PATH option's data pointer without first validating that the pointer is non-NULL, triggering a segmentation fault on receipt of a malformed packet. With CVSS A:H and no authentication required (PR:N/AC:L), this is a straightforward remote denial-of-service; no public exploit or KEV listing has been identified at time of analysis.

NULL pointer dereference in free5gc v4.0.1's UDMC registration handler exposes remote unauthenticated attackers to crashing the 5G core network process by submitting a specially crafted registration payload, resulting in complete availability loss of the affected network function. Any deployment with a network-accessible UDMC registration interface running free5gc v4.0.1 is at risk. No public exploit has been identified at time of analysis; EPSS exploitation probability is very low at 0.15% (4th percentile), consistent with the niche, research-oriented deployment footprint of this product.

NULL pointer dereference in free5gc v4.0.1's CDR processing path enables unauthenticated remote attackers to crash the 5G core network service by sending a crafted payload, causing a complete denial of service against the affected network function. The CVSS 7.5 score reflects a straightforward, credential-free network attack path requiring no complexity; however, EPSS places real-world exploitation probability at 0.18% (8th percentile), indicating limited threat actor interest at time of analysis. No public exploit code and no CISA KEV listing have been identified.

NULL pointer dereference in FFmpeg development snapshot N-122528-gdd2976b9e1 crashes the FFmpeg process when parsing a maliciously crafted video file via the get_min_buffer_size function in libswscale/slice.c. Any application or automated pipeline using this FFmpeg build to process untrusted video input is exposed to unauthenticated remote denial of service, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code exists at time of analysis, and EPSS at 0.15% (4th percentile) signals low current threat-actor activity.

NULL pointer dereference in the AMF NGAP Dispatcher of free5GC v4.0.1 allows an unauthenticated remote attacker to crash the Access and Mobility Management Function by sending crafted NGAP messages during the initialization of a new RAN connection, resulting in complete availability loss for the 5G core control plane. The AMF is a central 5G core component responsible for registration and mobility management for all connected user equipment, so a successful crash severs control-plane service for all gNBs attached to that AMF instance. No public exploit code has been confirmed and no CISA KEV listing exists at time of analysis, though SSVC rates the attack as Automatable given the no-authentication, low-complexity network exposure.

Null pointer dereference in Stomper (commit 5e2741e) allows any remote unauthenticated client to crash the STOMP server process by sending a SEND frame with the destination header omitted. The crash is deterministic and repeatable, making sustained denial-of-service trivially achievable without credentials or prior session state. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.15% (5th percentile) indicates low current exploitation probability, but the attack complexity is minimal for any attacker with network access to the service.

NULL pointer dereference in NVIDIA DGX Spark system firmware enables a local privileged attacker to achieve code execution with scope change into other system components. All versions of the DGX Spark firmware are affected per the wildcard CPE, with potential impacts spanning code execution, privilege escalation, denial of service, information disclosure, and data tampering. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote denial of service in OpenSSL's CMP subsystem affects versions 3.0.x through 4.0.x when password-based MAC (PBM)-protected messages are processed, caused by a missing ASN.1 type check that allows a crafted message to trigger an invalid pointer dereference before any MAC computation occurs. Unauthenticated remote attackers (CVSS PR:N) can crash applications acting as CMP servers via OSSL_CMP_SRV_process_request(), or crash CMP clients communicating with a malicious or intercepted CMP server. No public exploit has been identified at time of analysis; SSVC rates current exploitation as none, though the attack is rated automatable and requires no knowledge of the PBM shared secret.

NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted `signature_algorithms_cert` extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. No public exploit exists and CISA SSVC rates active exploitation as none, but the attack is automatable against any reachable endpoint in this non-default configuration.

Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the `pass` field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.