Windows Audio Service Information Disclosure Vulnerability

Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally...

Windows MIDI Service Module Elevation of Privileges Vulnerability

Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability

Null pointer dereference in Windows Universal Disk Format File System Driver UDFS allows an authorized attacker to execute code locally...

Windows Installer Elevation of Privilege Vulnerability

Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally...

Windows Clipboard Server Elevation of Privilege Vulnerability

Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...

Windows Schannel Elevation of Privilege Vulnerability

Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally...

Microsoft Windows VMSwitch Denial of Service Vulnerability

Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally...

CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...

CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet

FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...

CVE-2026-109942

FreeRDP versions 2.3.0 before 3.32.0 are vulnerable to a NULL Pointer Dereference in the rdg_process_close_packet function located in libfreerdp/core/gateway/rdg.c . The issue occurs because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and fails to check the payl...

CVE-2026-109939

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

CVE-2026-109939

FreeRDP versions 3.27.1 before 3.32.0 are vulnerable to a NULL pointer dereference within the update_read_cache_bitmap_v3_order() function in libfreerdp/core/orders.c. The flaw occurs because the software accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, despite the cache n...

CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order

FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...

CVE-2026-109679

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...

CVE-2026-109679

FreeRDP versions 3.0.0-beta4 before 3.32.0 are vulnerable to a NULL pointer dereference within the arm_handle_request_ok function. This issue occurs when a configured ARM gateway returns an empty HTTP 200 body, causing a zero-length body to pass a NULL value to strnlen . An attacker controlling t...

CVE-2026-90139

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE subsystem. When the fuseiget function fails to allocate an inode, such as under memory pressure, the subsequent fusefillsupersubmount function does not properly handle the returned null value. This oversight can lead to a null...

CVE-2026-90080

A flaw was found in the Linux kernel's octeontx2-pf driver. When switching to devlink eswitch mode, a null pointer dereference can occur in the afxdpzcqidx handling. This issue arises because the afxdpzcqidx pointer, which tracks receive queues, is not properly initialized in certain non-AFXDP...

CVE-2026-90066

A flaw was found in the Linux kernel's ftrace module. This vulnerability occurs because the ftracedirectmultiinit function does not properly check the return value of kthreadrun. If kthreadrun fails, an error pointer is assigned, which is later passed to kthreadstop during module unload. This...