CVE-2026-48438: NULL Pointer Dereference

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...

PT-2026-70306

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description A null pointer dereference within Ring 2 device drivers can lead to a denial of service. A remote, unauthenticated adversary can trigger this issue vi...

Oracle Linux 10 : kernel (ELSA-2026-34911)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34911 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-19411

The CVE-2026-19411 entry describes a NULL pointer dereference in the shim application of the dp.c library. The vulnerability occurs in the function is_removable_media_path() when devicepathtostr() returns NULL, potentially allowing a denial of service on systems that rely on the shim for the UEFI...

CVE-2026-19411 Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader...

CVE-2026-19411 Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader...

EUVD-2026-55805

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810

CVE-2026-11810 affects Zephyr’s UpdateHub firmware-update agent. The probe handler z_impl_updatehub_probe() parses CoAP-provided JSON metadata into a two-level nested array; it only validates the outer array length and then dereferences objects[1].objects[0].objects.sha256sum with strlen() withou...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...

CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...

UBUNTU-CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...

CVE-2026-71967 OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_session

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...

CVE-2026-71967

OP-TEE OS 4.10.0 contains a null pointer dereference in the Widevine PTA open_session handler. When CFG_WIDEVINE_PTA is enabled, Normal World clients can trigger an unconditional NULL dereference via is_user_ta_ctx(), crashing the TEE at S-EL1 and causing a Denial of Service. The issue is fixed i...

CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...