cve-2026-86547-mrubyc-op-enter

CVE-2026-86547 — mrubyc OPENTER NULL Pointer Dereference Standalone proof of concept for CVE-2026-86547 , a NULL pointer dereference in mrubyc's openter handler through release 4.0.0. Summary mrubyc is a lightweight Ruby implementation for embedded systems. Its bytecode VM keeps the current...

CVE-2019-10207

CVE-2019-10207 PoC for CVE-2019-10207 linux kernel: bluetooth: hciuart: kernel NULL pointer dereference gcc CVE-2019-10207.c -o cve-2019-10207-poc -static test on 4.20.0 kernel compile CONFIG must be opened: CONFIGBTHCIUARTMRVL=y CONFIGBTMRVL=y...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

CVE-2026-111710

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's userauth function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as on...

CVE-2026-111710

Netcore NR256CN through 1.5.140116 is affected by a NULL pointer dereference vulnerability within the Boa web server's user_auth() function. An unauthenticated attacker can trigger this vulnerability by sending a malformed Basic Authorization header that lacks a colon (e.g., decoding to a single ...

EUVD-2026-103002

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's userauth function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as on...

tpwn

tpwn cve-2015-???? poc os x 10.10.5 kernel local privilege escalation vulnerability got burned in 10.11 full writeup etason shout out @ unthreadedjb 4 hax Install NULLGuard to protect yourself against tpwn and other NULL Pointer Deference bugs...

CVE-2026-57486

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

CVE-2026-48741

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/isomms/server/mmsreadservice.c does not validate an alternate-access sub-array range when numberOfElements is...

CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

EUVD-2026-102928

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

CVE-2026-57486

The pupnp SDK for UPnP development applications is vulnerable to a NULL pointer dereference in ixml/src/node.c prior to version 2.0.2 . The ixmlNode_compare function incorrectly passes nullable fields (such as nodeValue, namespaceURI, prefix, and localName) of non-namespaced attributes directly t...

PoC-CVE-2025-69421

CVE-2025-69421 crash-only reproducer This repository contains a minimal malformed PKCS12 file that reproduces CVE-2025-69421 in an isolated laboratory environment. The generated PFX contains EncryptedData whose EncryptedContentInfo omits the optional encryptedContent field. Vulnerable OpenSSL...

IOFireWireFamily-null-deref

IOFireWireFamily-null-deref IOFireWireFamily-null-deref is a proof-of-concept exploit for CVE-2017-2388, a NULL pointer derefererence in IOFireWireUserClient that was fixed in macOS Sierra 10.12.4. This vulnerability can be triggered to cause denial of service on devices with a FireWire port...

CVE-2026-111129

A flaw was found in assimp. An attacker can exploit this flaw by convincing a user or automated system to process a specially crafted 3D mesh file containing invalid animation track targets. Parsing this file triggers an unhandled memory access error null pointer dereference in the Ogre mesh...

CVE-2026-111128

A flaw was found in Assimp. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application. The issue occurs within the Ogre3D importer, which fails to properly validate bone indices when parsing 3D model files. By supplying a specially crafted mesh or...

CVE-2023-3338-DECPwn

DECPwn Practicing different Linux kernel exploitation techniques with my DECnet vulnerability and null page mapping enabled. Scenarios Everything disabled : qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" Code execution is redirected to the output function in userland, which invokes...

NFSundown

Overview Proof-of-Concept exploit for NFSundown CVE-2025-38089. It can remotely trigger a kernel crash in an NFS server. Details A remote attacker can trigger a kernel null pointer dereference and crash the kernel by sending a specially crafted RPC request. This occurs due to improper handling of...

CVE-2026-111373

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...