108751 matches found
CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...
CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...
CVE-2026-109942
FreeRDP versions 2.3.0 before 3.32.0 are vulnerable to a NULL Pointer Dereference in the rdg_process_close_packet function located in libfreerdp/core/gateway/rdg.c . The issue occurs because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and fails to check the payl...
CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdgprocessclosepacket in libfreerdp/core/gateway/rdg.c because rdgprocesscontrolpacket accepts a header-only PKTTYPECLOSECHANNEL packet and passes the null payload without a check. A malicious or compromised RD Gateway can send an eight-by...
CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...
CVE-2026-109939
FreeRDP versions 3.27.1 before 3.32.0 are vulnerable to a NULL pointer dereference within the update_read_cache_bitmap_v3_order() function in libfreerdp/core/orders.c. The flaw occurs because the software accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, despite the cache n...
CVE-2026-109939
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in updatereadcachebitmapv3order in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3DONOTCACHE flag is set, even though the cache is not yet initialized before Demand Active. A malicious or compromised R...
CVE-2026-109679
FreeRDP versions 3.0.0-beta4 before 3.32.0 are vulnerable to a NULL pointer dereference within the arm_handle_request_ok function. This issue occurs when a configured ARM gateway returns an empty HTTP 200 body, causing a zero-length body to pass a NULL value to strnlen . An attacker controlling t...
CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...
CVE-2026-109679
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in armhandlerequestok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client...
CVE-2026-90130
A flaw was found in the vdpasim component of the Linux kernel. During the cleanup process after a worker creation failure, an invalid pointer is dereferenced. This improper error handling can lead to a general protection fault, resulting in a system crash and a Denial of Service DoS...
CVE-2026-90139
A flaw was found in the Linux kernel's Filesystem in Userspace FUSE subsystem. When the fuseiget function fails to allocate an inode, such as under memory pressure, the subsequent fusefillsupersubmount function does not properly handle the returned null value. This oversight can lead to a null...
CVE-2026-90080
A flaw was found in the Linux kernel's octeontx2-pf driver. When switching to devlink eswitch mode, a null pointer dereference can occur in the afxdpzcqidx handling. This issue arises because the afxdpzcqidx pointer, which tracks receive queues, is not properly initialized in certain non-AFXDP...
CVE-2026-90066
A flaw was found in the Linux kernel's ftrace module. This vulnerability occurs because the ftracedirectmultiinit function does not properly check the return value of kthreadrun. If kthreadrun fails, an error pointer is assigned, which is later passed to kthreadstop during module unload. This...
CVE-2026-90060
A flaw was found in the Linux kernel's ALSA control module. A local user could create a write-only kcontrol element without a get callback. This could lead to a null pointer dereference in the LED layer, causing a system crash and resulting in a denial of service...
CVE-2026-90115
A flaw was found in the Linux kernel's AFXDP xsk socket multi-buffer receive path. This vulnerability allows for a NULL pointer dereference in the xskrcv function due to improper handling of buffer allocation failures. An attacker could exploit this flaw to cause a system crash, leading to a Deni...
CVE-2026-90102
A flaw was found in the Linux kernel's NFSv4/pnfs component. The data server cache is incorrectly keyed only on the multipath address set, without considering the NFS version. This oversight allows different NFS versions to share the same internal data structure when two device IDs on one address...
CVE-2026-90091
A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A race condition, a situation where multiple operations occur at the same time and interfere with each other, exists between internal functions. This can lead to a null pointer...
CVE-2026-109774
The Firefox browser is affected by an invalid pointer vulnerability leading to undefined behavior within the DOM: Notifications component . This issue was addressed and fixed in Firefox 158 . No specific exploit information or links to in-the-wild exploitation are provided in the documentation.