CVE-2026-71200

If a KDC is configured to allow PKINIT authentication, an unauthenticated attacker can trigger a null pointer dereference, causing the process to terminate. Mitigation Disable PKINIT on the KDC if certificate-based authentication is not required, or restrict network access to the KDC service usin...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

CVE-2026-125107

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms...

CVE-2026-90587 NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587 NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-73857 ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

CVE-2026-125107 Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms...

CVE-2026-125107 Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms...

EUVD-2026-120461

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms...

CVE-2026-125107

The Muhammara node module, which provides c/cpp bindings for PDF manipulation in Node.js or Electron, is vulnerable to a NULL pointer dereference in PDFParser::CreateFilterForStream(). This occurs when a PDF stream uses the LZWDecode filter with a /DecodeParms dictionary that omits the EarlyChang...

CVE-2026-125225

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...

CVE-2026-125231

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...

CVE-2026-125215

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ffdovirpugenerate in libavcodec/dovirpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovirpu...

CVE-2026-125216

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

CVE-2026-125174

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ffhapsetchunkcount in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes...

CVE-2026-125067

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

CVE-2026-125069

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125071

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe...

CVE-2026-125072

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

CVE-2026-125068

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...