CVE-2026-105923

The VectorImage QML Type is vulnerable to a null-pointer dereference caused by an integer overflow . This issue can be triggered by processing a malicious SVG file, which leads to an impact on availability . No specific exploit details or remediation versions are provided in the documents.

CVE-2026-105923 Null-pointer dereference in QTriangulator reachable through VectorImage

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...

EUVD-2026-107159

A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type...

DEBIAN-CVE-2026-114046

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

CVE-2026-114046

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

CVE-2026-114046

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a null-pointer dereference within the smartcard emulation backend. The issue occurs when the backend accepts a null per-reader name during SCardGetStatusChange requests. A malicious RDP server can trigger this by sending a crafted reader-stat...

EUVD-2026-106997

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

CVE-2026-114046

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...

SUSE CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

PT-2026-120548

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

PT-2026-120550

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-120637

A NULL pointer dereference in the gf ac4 presentation ch mode function /media tools/av parsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

EUVD-2025-211149

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60469

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60479

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

PT-2026-120605

A NULL pointer dereference in the StatSFVec2f function /scene manager/scene stats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

EUVD-2025-211165

A NULL pointer dereference in the gfac4presentationchmode function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...