CVE-2025-60489

The GPAC Project/MP4Box software version before 2.5 is vulnerable to a NULL pointer dereference within the dasher_insert_timeline_entry function located in /filters/dasher.c. An attacker can exploit this flaw by providing a crafted MP4 file to trigger a Denial of Service (DoS) . While a fix is re...

Linux Distros Unpatched Vulnerability : CVE-2026-109939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap...

Linux Distros Unpatched Vulnerability : CVE-2026-109241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients b...

Linux Distros Unpatched Vulnerability : CVE-2026-107778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services ...

Linux Distros Unpatched Vulnerability : CVE-2026-109679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-114046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange...

PT-2026-120172

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

Linux Distros Unpatched Vulnerability : CVE-2026-105923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. CVE-2026-105923 Note that Nessus reli...

SUSE CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

SUSE CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

SUSE CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

practice-22-23

Project To run: ./script.sh GitHub repository - https://github.com/LaCinquette/practice-22-23 Progress 1. For vulnerability research I chose the FFmpeg project. I found a commit that met the requirements, namely: Matched the type CWE-476 - null pointer dereference 2. Created a Dockerfile in which...

CVE-2026-113680

A flaw was found in HarfBuzz. This vulnerability allows an attacker to cause a Denial of Service DoS by supplying a specially crafted font containing an embedded WebAssembly Wasm module. When an application shapes text using the malicious font, the module passes out-of-range memory addresses to...

CVE-2026-64593

A flaw was found in the btrfs filesystem of the Linux kernel. A local user could trigger a system crash by attempting to perform a trim operation on a storage device that was previously unavailable but has since reconnected and is not writeable. This issue arises from a synchronization problem...

CVE-2026-87117

A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service DoS by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users...

CVE-2026-89784

A flaw was found in the Linux kernel's SUNRPC component. When an in-kernel RPC service registers with the local rpcbind under memory pressure, a failure in memory allocation can lead to a NULL pointer being dereferenced. This unchecked NULL pointer can cause the kernel to crash, resulting in a...

CVE-2026-80912

A flaw was found in the Linux kernel's SELinux subsystem. When processing security class values, the securitygetclasses function could return a null pointer if a class value was not properly defined by the security policy. This could lead to a null pointer dereference, potentially causing a syste...

CVE-2026-80730

A flaw was found in the Linux kernel. The ring-buffer component's cleanup routine can incorrectly attempt to stop a kernel thread using an invalid error pointer. This happens when kthreadrunoncpu fails, storing an error pointer in the rbthreads array. Calling kthreadstop on this invalid pointer...

CVE-2026-97605

A flaw was found in the Linux kernel. When resizing the decompression stream pool in the Enhanced Read-Only File System EROFS encounters a memory allocation failure, an uninitialized stream is improperly retained in the active pool. A local user accessing or decompressing an affected filesystem c...

CVE-2026-93212

A flaw was found in the Linux kernel NFS daemon nfsd. During network teardown, the nfsdserv pointer is prematurely cleared while the file cache cleanup process is still active. This can lead to a null pointer dereference in the nfsdfilenetdispose function. Exploiting this vulnerability could caus...