OESA-2026-4358 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O...

CVE-2026-98416

A flaw was found in the Linux kernel's Texas Instruments K3 UDMA Unified Direct Memory Access driver. This vulnerability can lead to a Denial of Service DoS caused by a null pointer dereference when freeing resources during a failed channel request. Under resource-exhaustion conditions, the...

CVE-2026-98412

A flaw was found in the Linux kernel's power sequencing subsystem. If a memory allocation failure occurs while setting up dependencies in pwrsequnitsetupdeps, error handling cleans up the partially allocated unit without having initialized its internal list. This uninitialized state leads to a NU...

CVE-2026-111129

A flaw was found in assimp. An attacker can exploit this flaw by convincing a user or automated system to process a specially crafted 3D mesh file containing invalid animation track targets. Parsing this file triggers an unhandled memory access error null pointer dereference in the Ogre mesh...

CVE-2026-111128

A flaw was found in Assimp. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application. The issue occurs within the Ogre3D importer, which fails to properly validate bone indices when parsing 3D model files. By supplying a specially crafted mesh or...

CVE-2026-111373

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-111373

FreeRDP versions before 3.32.0 are vulnerable to a NULL pointer dereference within the websocket transport component. A malicious gateway or remote server can trigger a Denial of Service (DoS) by sending a zero-length WebSocket ping message. During processing, the websocket_reply_pong function pa...

CVE-2026-111373 FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-111373

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

EUVD-2026-102554

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

UBUNTU-CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

UBUNTU-CVE-2026-111373

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-111129

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)

The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...

Linux Distros Unpatched Vulnerability : CVE-2026-111144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a...

Linux Distros Unpatched Vulnerability : CVE-2026-111373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending...

Linux Distros Unpatched Vulnerability : CVE-2026-111129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's...

Linux Distros Unpatched Vulnerability : CVE-2026-111128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone...

PT-2026-116109

🚨 CVE-2026-111710 Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user auth function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking ...