Null Pointer Dereference

NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.

Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.

NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.

Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.

Denial of service in MZ Automation's libiec61850 library allows a network-adjacent attacker to crash an IEC 61850 MMS server by sending a specially crafted WriteRequest whose listOfData field is empty, triggering a NULL pointer dereference (CWE-476) in the Write Named Variable List handler. Any device or application embedding the affected library as an MMS server - commonly protection relays, RTUs, gateways, and SCADA front-ends in electric-power and industrial environments - is exposed. Reported through CISA ICS-CERT (advisory ICSA-26-204-06) with no public exploit identified at time of analysis and no CISA KEV listing.

MongoDB Server terminates abnormally during outbound TLS handshake when a remote peer delivers a malformed OCSP response, producing a denial-of-service condition against the database process itself. OCSP stapling validation is enabled by default for all outgoing TLS connections, meaning no operator misconfiguration is required to expose this attack surface - any MongoDB server initiating TLS connections is potentially reachable. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the default-enabled feature combined with the adjacent-network attack vector makes this a credible operational risk for MongoDB clusters traversing partially trusted or shared network segments.

Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.

Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.

Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.

Null pointer dereference in Gitea's AddTime API (versions prior to 1.27.0) allows an authenticated repository administrator to crash the server by specifying a non-existent username in a time-tracking request. The root cause is a missing `return` statement in `routers/api/v1/repo/issue_tracked_time.go` after `GetUserByName()` returns an error, causing `AddTime()` to dereference a nil user pointer and trigger a Go runtime panic. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept is embedded in the GHSA advisory, making the issue trivially reproducible by any repository administrator.

NULL pointer dereference in NanoMQ 0.24.11 and earlier allows an authenticated REST API user to crash the entire broker process with a single malformed HTTP request. The `properties_parse()` function fails to validate that `user_properties` is a JSON object before iterating its elements, calling `strlen()` on a NULL pointer and causing a fatal segmentation fault. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available in version 0.24.14.

NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.

NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.

Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.

NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.

NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.

Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

NULL pointer dereference in the Linux kernel's EFI runtime subsystem crashes affected systems when ACPI Platform Runtime Mechanism (PRM) handlers are invoked during early boot before the EFI runtime workqueue has been allocated. Systems with EFI PRM-capable firmware running unpatched kernels between the introduction of commit 5894cf571e14 and the respective stable-branch fixes are affected. No public exploit or CISA KEV listing exists; the vulnerability manifests as a kernel panic during initialization on susceptible hardware, resulting in a denial of service.

NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.

Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.

Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.

Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.

NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.

Early boot initialization on ARM Integrator/CP hardware in the Linux kernel triggers a NULL pointer dereference by invoking memory allocation routines before the memory management subsystem is operational, causing a kernel panic that renders affected systems unbootable. The regression was introduced by commit bdb249fce9ad4 and affects all Linux stable branches from that point through patched releases (5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1). No public exploit exists, CISA KEV does not list this vulnerability, and EPSS sits at 0.17% (7th percentile), reflecting the narrowly scoped, hardware-specific nature of the defect.

Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.

Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).

Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.

Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.

Null pointer dereference in the Linux kernel's Bluetooth ISO reassembly path allows any Bluetooth broadcaster within radio range to crash a victim Linux host by transmitting an ISO_END PDU without a preceding ISO_START on a BIS (Broadcast Isochronous Stream) connection. Affected kernels span all stable branches from the ISO introduction commit (ccf74f2390d60a2f9a75ef496d2564abb478f46a) through fixed releases 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.18% (8th percentile), reflecting low current exploitation probability despite the unauthenticated wireless trigger available to BIS attackers.

NULL pointer dereference in the Linux kernel's ethtool PHY subsystem allows a local low-privileged user to crash the kernel and cause a denial of service. The flaw in `phy_prepare_data()` fails to check return values from `kstrdup()` for the strings `name`, `drvname`, `upstream_sfp_name`, and `downstream_sfp_name`; when allocation fails and returns NULL, `phy_reply_size()` subsequently calls `strlen()` unconditionally on the NULL pointer, triggering a kernel oops and system panic. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), but the availability impact is total - a kernel panic - making this a standard patching priority for any multi-user or shared Linux environment.

Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.

NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.

NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.

NULL pointer dereference in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by replacing the framebuffer modelist via sysfs while fbcon is unbound. The crash occurs when a subsequent console takeover calls fb_videomode_to_var() with a NULL mode pointer, resulting from the broken invariant that info->var always has a matching entry in info->modelist. No public exploit or CISA KEV listing exists; EPSS of 0.18% (7th percentile) reflects negligible observed exploitation interest.

Use-after-free in the Linux kernel NFS server (nfsd) pNFS layout code allows an NFSv4.1+ client to leave a freed layout state ID published in the client's IDR when nfsd4_layout_setlease() fails, so any later IDR walk (states_show, client teardown) dereferences a dangling slab pointer. The affected component is the pNFS block/SCSI/flexfiles layout server path on kernels between commit c5c707f96fc9 and the fixed stable releases. No public exploit has been identified and it is not in CISA KEV; the practical impact is kernel memory corruption leading to crash (DoS) and possible information disclosure per the vendor tag, though the auto-assigned CVSS of 9.8 significantly overstates real-world exploitability.

Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.

Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.

Null pointer dereference in the Linux kernel's virtual console screen (vc_screen) subsystem causes a local denial-of-service via kernel panic. The flaw exists in vcs_write(), where a race condition between concurrent writes and virtual console deallocation leaves a stale vc_data pointer that is subsequently dereferenced in the notifier chain. An authenticated local user with write access to /dev/vcs* devices can trigger this to crash the kernel. No public exploit exists and EPSS is very low at 0.19% (9th percentile), though the fix is confirmed available across multiple stable kernel branches.

Denial of service in the Linux kernel in-kernel SMB3 server (ksmbd) lets remote, unauthenticated clients crash the ksmbd worker via a crafted COMPOUND request. Because smb2_check_user_session() skips the SMB2_SESSION_VALID state check for non-first compound operations and treats a SessionId of 0xFFFFFFFFFFFFFFFF as automatically valid, a TREE_CONNECT chained onto a half-open session (created by an NTLM Type-1 negotiate blob, sess->user still NULL) reaches ksmbd_ipc_tree_connect_request() and dereferences a NULL pointer, wedging the worker for all clients. EPSS is low (0.23%, 13th percentile) and there is no public exploit identified at time of analysis.

NULL pointer dereference in the Linux kernel's vidtv virtual DVB test driver crashes the kernel when memory allocation fails silently during PID context initialization. Systems running kernel versions between the introducing commit (f90cf6079bf6) and the patched releases with CONFIG_DVB_VIDTV enabled are vulnerable to local denial of service. No public exploit is identified at time of analysis, and EPSS probability is 0.19% (9th percentile), indicating very low exploitation likelihood; the vulnerability is absent from CISA KEV.

Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist.

Nil pointer dereference in CoreDNS prior to 1.14.5 allows remote unauthenticated attackers to crash or degrade the DNS server by sending a single ordinary DNS query. The rewrite plugin's edns0 response rules dereference the result of IsEdns0() without a nil check; when a downstream plugin returns a response lacking an OPT record, the ResponseReverter panics, returning SERVFAIL in default deployments or terminating the CoreDNS process entirely when the debug directive is active. No public exploit code has been identified and the issue is fixed in v1.14.5.

Remote denial of service in CoreDNS versions prior to 1.14.4 allows an unauthenticated attacker to crash the DNS server with a single 28-byte UDP datagram when the proxyproto plugin is enabled. The malformed PROXY protocol v2 header triggers a nil pointer dereference in the PacketConn.ReadFrom log path, killing the process before per-request recovery can intervene. No public exploit identified at time of analysis, though the fixing PR includes a reproducer test that encodes the exact crashing byte sequence; not listed in CISA KEV.

Deterministic nil-pointer dereference in Envoy Gateway's gatewayapi runner allows a low-privileged tenant to permanently stall controller-wide xDS and Infrastructure IR publishing by submitting a single malformed CRD. Any tenant with namespace-scoped RBAC permission to create SecurityPolicy and TCPRoute resources can trigger a panic on every reconcile cycle by omitting the spec.authorization field, requiring administrator intervention to restore control-plane operations. No exploitation confirmed in the wild (not in CISA KEV); patches are available in versions 1.7.4 and 1.8.1.

Denial of service in F5 NGINX Ingress Controller allows an authenticated remote attacker holding write access to Ingress or TransportServer resources to crash the control plane by submitting a malformed resource. Because the offending resource persists in the cluster, the controller re-reads it and re-crashes, producing a durable crash loop rather than a one-time outage. There is no public exploit identified at time of analysis, and impact is confined to the control plane with no data plane or confidentiality/integrity exposure.

Denial of service in the Matter SDK (connectedhomeip) before 1.4.0 lets a remote unauthenticated attacker crash a smart-home device by sending a crafted read request. The flaw lives in the ReadRevisionAttribute function, which is reused across multiple clusters (Channel, Account Login, TargetNavigator), so any device exposing those clusters is affected. No public exploit identified at time of analysis, and the issue is availability-only (no code execution or data exposure).

Null pointer dereference in the Windows SMB Server component allows an authenticated network attacker to crash the service across multiple Windows 10, 11, and Server editions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network exploitability with low-privilege credentials and complete availability impact, though confidentiality and integrity are unaffected. No public exploit identified at time of analysis; SSVC exploitation status is 'none' and EPSS sits at 0.79%, indicating low active exploitation pressure despite the broad product footprint.

Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker gain elevated (SYSTEM-level) privileges by triggering a NULL pointer dereference (CWE-476) in kernel-mode code. The flaw affects a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Reported by Microsoft with a patch available; no public exploit identified at time of analysis.

Null pointer dereference in Active Directory Domain Services (AD DS) on Windows allows an authenticated, network-adjacent attacker to crash the service and deny domain authentication to all dependent users and systems. Affecting Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2025, this vulnerability carries a CVSS 6.5 with high availability impact. No public exploit identified at time of analysis and CISA SSVC assesses exploitation as none with non-automatable attack path, keeping real-world urgency at moderate despite the breadth of affected platforms.

Local privilege escalation in Windows Image Acquisition (WIA) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a NULL pointer dereference can be leveraged by an already-authenticated local user to elevate privileges. Microsoft rates it 7.8 (High) with full confidentiality, integrity, and availability impact despite the flaw class typically causing denial of service. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged authenticated attacker to crash the service remotely, causing denial of service across the affected domain. The flaw spans a wide range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 version 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, though the network-accessible attack surface and low privilege requirement lower the bar for abuse in environments with broad domain user access.

NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.

Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a connecting client by returning a malformed Server_NamespaceArray during session establishment, causing denial of service. The flaw is client-side only - server deployments are unaffected - and exploitation requires the attacker to control or impersonate a server the vulnerable client connects to, making practical exploitation high-complexity. A proof-of-concept exists as a GitHub issue report; no public exploit is confirmed as weaponized and the vulnerability is not listed in CISA KEV.

Denial of service in the Crypt::OpenSSL::X509 Perl module before 2.1.3 lets a malformed X.509 certificate crash any Perl process that parses it. Four helper functions (basicC, ia5string, auth_att, keyid_data) dereference NULL pointers returned by OpenSSL's X509V3_EXT_d2i() on unparseable extensions - and keyid_data/auth_att additionally deref an akid->keyid field that is legitimately NULL for an empty Authority Key Identifier (DER 30 00). There is no public exploit identified at time of analysis, but the fix commit and a clear crash mechanism are published; CVSS is 7.5 (availability-only).

NULL pointer dereference in NanaZip's custom archive handlers crashes the application when a user tests or extracts archives of seven specific formats. All NanaZip versions prior to 6.5.1749.0 are affected; the seven vulnerable handlers cover WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archive types. Impact is limited to a process crash (denial of service) with no confidentiality or integrity consequence; no public exploit or active exploitation has been identified at time of analysis.

NULL pointer dereference in the Juniper Networks Junos OS and Junos OS Evolved management daemon (mgd) allows a local, high-privileged attacker to crash the mgd process by manipulating a specific 'system services ssh' configuration parameter. Repeated execution of the offending configuration commands sustains the Denial of Service condition until the action ceases, as mgd will restart but crash again upon re-triggering. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; the attack barrier is high, requiring both local access and administrative-level credentials.

Denial of service in Zeek (formerly Bro) network security monitor before 8.0.9 lets remote unauthenticated attackers crash the sensor by sending a single crafted Kerberos KRB_ERROR packet. The flaw is a null pointer dereference (CWE-476) in the Kerberos analyzer's proc_padata() routine, reachable over UDP or TCP port 88 with no credentials. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial single-packet trigger and passive-monitoring exposure make it operationally significant for security teams running Zeek inline or on tapped traffic.

Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.

GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.

Wireshark's SSH protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.4.0-4.4.16 and 4.6.0-4.6.6, enabling denial of service against any analyst or engineer running an affected build. The flaw is triggered locally when Wireshark processes malformed SSH protocol data, whether from a live capture or a crafted packet capture file, causing the application to crash and disrupting network analysis workflows. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis.

Denial of service in Wazuh wazuh-modulesd (all releases before 5.0.0-beta3) lets an enrolled agent crash the manager's inventory synchronization module by sending a verifier-valid FlatBuffer DataValue message that omits the optional id field, triggering a null pointer dereference (CWE-476). Exploitation requires only a valid enrolled agent (PR:L) over the network with no user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only - no data confidentiality or integrity loss - but it can repeatedly take down central inventory sync, blinding a security monitoring deployment.

NULL pointer dereference in SQLite's Session Extension crashes any application that passes attacker-controlled changeset blobs to sqlite3changeset_apply_v3(). Affected releases include SQLite 3.53.1 and all trunk builds prior to check-in e807d4e3798efd53. Impact is limited to availability - the process crashes - but because SQLite is embedded ubiquitously, the blast radius depends entirely on how widely consuming applications expose this code path to untrusted input. A public proof-of-concept gist is referenced in the CVE record; no public exploit identified at time of analysis beyond that demonstrator, and the vulnerability is not listed in CISA KEV.

Null pointer dereference in the ONNX Python library's version converter crashes any application that calls `onnx.version_converter.convert_version()` on a crafted model containing an Upsample node with zero inputs, producing an unrecoverable SIGSEGV. Affected versions include at minimum onnx 1.21.0 and 1.22.0, confirmed by a 107-byte public proof-of-concept; the vulnerability is part of a systemic pattern spanning eight adapters. No public active exploitation is confirmed in CISA KEV, but the trivially small PoC eliminates any meaningful exploitation barrier for threat actors targeting ML model conversion pipelines.

Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.

NULL pointer dereference in GPAC's smooth_parse_stream_index() function crashes the application when processing a maliciously crafted MPEG-DASH or Smooth Streaming media file, resulting in denial of service. Affected versions are all GPAC master HEAD builds prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5. Exploitation requires local access and user interaction to open a crafted file; a proof-of-concept is publicly available via GitHub Gist, though EPSS sits at 0.17% (7th percentile) and no active exploitation has been confirmed by CISA KEV.

Null Pointer Dereference in Adobe DNG SDK versions 1.7.1 build 2536 and earlier allows an attacker to crash any application embedding the SDK by supplying a specially crafted DNG file. The flaw is strictly a denial-of-service with no confidentiality or integrity impact, and requires a victim to open the malicious file, constraining realistic exposure to imaging pipelines or end-user applications that ingest untrusted DNG content. No public exploit code and no active exploitation have been identified at time of analysis.

Null pointer dereference in GPAC 26.02.0's nhmldump_send_frame function (src/filters/write_nhml.c) allows a local, low-privileged attacker to crash the application by supplying crafted media input to the NHML write filter. Impact is strictly limited to availability - a process-level denial of service with no confidentiality or integrity implications. A publicly available proof-of-concept exploit exists (GitHub issue #3596), though the vendor itself characterizes this class of issue as 'more bugs than vulns,' contextualizing it as a robustness fix rather than an urgent security incident.

Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to crash the entire server by sending a second INFO protocol message before CONNECT on the leafnode port, triggering a nil-pointer dereference (c.acc == nil) that panics the process. All server instances exposing a leafnode listener prior to v2.11.17 (2.11.x) and v2.12.8 (2.12.x) are affected. No public exploit has been identified, but the vendor's own regression test (TestLeafNodeSecondInfoBeforeConnectDoesNotPanic) demonstrates the exact crash payload, and the CVSS availability-only vector (7.5) reflects a single-packet, no-auth crash.

Denial of service in the mruby/c lightweight Ruby VM (all releases through 3.4.1) arises from a NULL pointer dereference in op_super()/OP_SUPER within src/vm.c, where a runtime guard for a top-level 'super' call is missing. When the interpreter executes a script that invokes 'super' outside of any method context, the VM dereferences a NULL pointer and crashes. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) reflects limited exploitation interest; impact is confined to availability (CWE-476).

NULL pointer dereference in the Zephyr RTOS MAX32xxx USB device controller driver (udc_max32.c) crashes devices running Zephyr v4.4.0 when a physically connected USB host aborts an in-flight EP0 control transfer by sending a new SETUP packet - a completely legal USB protocol action. The race condition between interrupt-queued transfer-completion events and asynchronous FIFO draining by the driver thread causes net_buf_add(NULL, ...) when udc_buf_get() returns NULL on an empty FIFO, producing a near-NULL pointer dereference and device fault. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis; real-world risk is constrained by the physical access prerequisite and the specific MAX32xxx hardware dependency.

Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sending specially crafted IKEv2 messages that trigger a null pointer dereference (CWE-476). The flaw affects appliances running Mobile User VPN with IKEv2 or Branch Office VPN over IKEv2 with a dynamic gateway peer, spanning Fireware OS 11.10.2 through 2026.2. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss.

Insufficient intelligence to synthesize. CVE-2026-47709 description is marked unknown, CVSS vector is not available, CWE is not available, and no product name or affected versions are specified - only that Ubuntu reported it. Comprehensive vulnerability analysis requires description, CVSS vector, affected product details, and remediation data.

Denial-of-service via NULL pointer dereference in PipeWire's RAOP (Remote Audio Output Protocol) module affects Red Hat Enterprise Linux 8, 9, and 10. The RAOP module fails to enforce an upper bound on Content-Length values in incoming requests and does not validate the return value of pw_array_add(); when a sufficiently large Content-Length triggers an allocation failure, the unchecked NULL return causes a crash of the PipeWire daemon, resulting in complete loss of audio services. No special authentication is required from the adjacent network, and no public exploit or CISA KEV listing has been identified at time of analysis.

Memory-management flaw in the Linux kernel's RDS (Reliable Datagram Sockets) InfiniBand transport leaves a dangling pointer (i_sends) after a failed connection setup, which a later teardown pass can treat as a live send-ring allocation. The bug is fixed upstream and backported across many stable series, but there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), indicating it is not a broadly weaponized issue. The NVD-published CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, error-path use-after-free in a rarely enabled kernel module.

NULL pointer dereference in the Linux kernel's ASoC wm_adsp driver crashes the kernel when firmware controls are removed without a prior NULL check on private control data. Systems running affected kernel versions (5.16 through multiple stable branches) with Wolfson/Cirrus Logic ADSP hardware are exposed to local denial-of-service via kernel panic. No active exploitation has been identified, EPSS sits at 0.16% (6th percentile), and patches have been backported to all active stable branches.

NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.

NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.

NULL pointer dereference in the Linux kernel's Airoha QDMA network driver crashes the kernel when a misconfigured Device Tree Source (DTS) causes `of_reserved_mem_lookup()` to return NULL without a guard check. Systems running the `net/airoha` driver with a DTS referencing a non-existent or removed `memory-region` node in the reserved memory table trigger a kernel panic during driver initialization at `airoha_qdma_init_hfwd_queues()`. The impact is exclusively a local denial-of-service (system crash); no confidentiality or integrity compromise is possible. No public exploit exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with the highly specific hardware and configuration prerequisites.

NULL pointer dereference in the Linux kernel bonding subsystem crashes the kernel when a local user with CAP_NET_ADMIN invokes bond_do_ioctl() with a non-existent slave interface name. The slave_dbg() macro unconditionally dereferences slave_dev->name before the NULL guard is evaluated, producing a kernel oops and local denial-of-service. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), indicating very low observed exploitation activity; patches are available across all active stable branches.

NULL pointer dereference in the Linux kernel's DAMON LRU Sort subsystem crashes the kernel when damon_ctx allocation fails under memory pressure. Affected are Linux kernel versions through 6.18 and 7.0.x before 7.0.13, where damon_lru_sort_enabled_store() omits a NULL check before passing the allocation result to damon_commit_ctx(). A local attacker with low privileges can trigger a kernel panic, causing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.17% (6th percentile), reflecting negligible observed exploitation activity.

NULL pointer dereference in the Linux kernel's DAMON_RECLAIM memory management subsystem crashes the kernel when a `damon_ctx` object allocation fails during initialization. Local users with low privileges can trigger this by enabling DAMON_RECLAIM via its sysfs interface while the system is under memory pressure, causing `damon_commit_ctx()` to dereference a NULL pointer and inducing a kernel panic. No active exploitation is identified; EPSS of 0.17% (6th percentile) and absence from CISA KEV confirm this remains a low-probability, theoretically triggerable denial-of-service condition.

Remote denial of service in the MediaTek Modem firmware component affects approximately 60 chipset models via a null pointer dereference triggered when a target device connects to a rogue cellular base station. An attacker controlling a fake eNodeB or gNodeB can transmit crafted modem protocol messages that cause improper input validation to fail, crashing the modem and stripping affected devices of cellular connectivity. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation status as none, indicating this remains a theoretical but technically feasible threat for well-resourced actors.

Null pointer dereference in MPC-BE's MP4 parsing layer crashes the application when a crafted MP4 file is opened, resulting in a Denial of Service. The defect resides in AP4_TkhdAtom::GetTrackId() - a function inherited from the Bento4 media library used internally by MPC-BE - and is fixed in commit 4341cb3. No active exploitation is recorded (EPSS 0.15%, 5th percentile; not in CISA KEV), and SSVC assesses technical impact as only partial with no automatable exploitation path.

Denial of service in Aleksoid1978 MPC-BE (Media Player Classic - Black Edition) prior to commit 4341cb3 lets an attacker crash the player by supplying a crafted MP4 file that triggers a NULL pointer dereference in the bundled Bento4 AP4_AtomSampleTable::GetSample() routine. A proof-of-concept is referenced (SSVC exploitation: poc), but there is no public exploit identified as weaponized and it is not in CISA KEV; impact is limited to availability with no code execution, data disclosure, or integrity loss. EPSS is low at 0.15% (5th percentile), consistent with a crash-only bug that requires a victim to open a malicious file.

Unauthenticated NULL pointer dereference in Woodpecker CI before 3.15.0 allows any network attacker to flood server logs by repeatedly probing the unprotected /api/orgs/lookup/ endpoint. The LookupOrg handler unconditionally dereferences the session user object, which is nil for unauthenticated callers, triggering a Go panic on every such request; gin's recovery middleware catches each panic and returns HTTP 500, keeping the server alive but writing approximately 37 lines of stack trace per request to the error log. No active exploitation is confirmed in CISA KEV, but the zero-prerequisite attack surface - no credentials, no special configuration, no user interaction - makes low-bandwidth log-flooding trivially achievable by any unauthenticated network attacker.

Denial of service in Zephyr RTOS v4.4.0 allows an attacker with access to a serial, UART, or shell-console interface to crash an affected embedded device by exhausting the MCUmgr shared buffer pool and triggering a NULL pointer dereference. The defect in mcumgr_serial_process_frag() (CWE-476) was introduced during the MCUmgr rework and manifests in default builds where assertion checks are compiled out, making the write-through-NULL a hard fault rather than a caught assertion. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but exploitation is straightforward for any attacker with interface access.

Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.

NULL pointer dereference in the Linux kernel's AMD64 AGP driver crashes systems running in virtualized environments without physical AMD northbridge hardware. Broken error propagation in `agp_amd64_probe()` - comparing `cache_nbs()` return value against exactly `-1` rather than `< 0` - masks the `-ENODEV` error code, allowing the driver to proceed with initialization, ultimately causing a General Protection Fault in `amd64_fetch_size()` when `node_to_amd_nb(0)` returns NULL. No public exploit has been identified at time of analysis, EPSS is 0.18% (7th percentile), and impact is confined to local denial of service via kernel crash; patches are confirmed available across multiple stable branches.

NULL pointer dereference in the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client crashes devices running Zephyr v4.3.0 and v4.4.0 (and earlier) when connected to a malicious or buggy remote ASCS server. The handler unicast_client_ep_qos_state() writes attacker-controlled QoS fields through stream->qos without verifying the pointer is non-NULL - a condition that legitimately exists during the window between bt_bap_stream_config() and unicast_group_add_stream(). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but CVSS adjacency (AV:A) and no-auth (PR:N) make it exploitable by any device within Bluetooth LE radio range acting as a rogue ASCS server.

NULL pointer dereference in the Linux kernel MANA (Microsoft Azure Network Adapter) driver crashes the host kernel when initializing Virtual Function (VF) devices in VFIO passthrough or nested KVM environments where `pdev->slot` is unpopulated. Systems running affected kernel versions in Azure-style or nested virtualization deployments face deterministic kernel panics and total availability loss on the host. No public exploit code has been identified, and EPSS probability is 0.16% (5th percentile), indicating low opportunistic exploitation risk - though in targeted Azure or nested KVM environments, the crash is straightforwardly reproducible.