By weakness (CWE)

CWE-476: related vulnerabilities

CVEs classified under CWE-476. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

51 published vulnerabilities

• CVE-2025-59604HIGH 7.8

  CVE-2025-59604 is a memory corruption vulnerability affecting Qualcomm Snapdragon processors across multiple generations. The flaw occurs during memory copy operations when a null pointer is dereferenced, causing invalid writes to memory. An attacker with local access to a device can exploit this to gain elevated privileges and potentially read or modify sensitive data. The vulnerability is rated HIGH severity and requires local execution context, meaning an attacker must already have a foothold on the device.

• CVE-2025-59606HIGH 7.8

  CVE-2025-59606 is a memory corruption vulnerability affecting multiple Qualcomm chipsets and wireless components. The flaw occurs when a device exhausts heap memory during secure data initialization, causing the firmware to write to invalid memory locations. An attacker with local access and limited privileges can exploit this to crash the system or potentially execute code with elevated permissions. This is a local privilege escalation risk rather than a remote attack vector.

• CVE-2025-70099HIGH 7.5

  A vulnerability in the lwext4 library (version 1.0.0) can crash applications that process specially crafted EXT4 filesystem images. The flaw occurs when the code attempts to read file information from a corrupted directory entry without first verifying the entry pointer exists. An attacker could provide a malicious filesystem image to trigger this crash, disrupting service availability. This is a denial-of-service issue with no data theft or system compromise risk.

• CVE-2026-3238HIGH 7.5

  Samba's WINS server component contains a vulnerability that allows an unauthenticated attacker to crash the WINS service when Samba is configured as an Active Directory Domain Controller. The flaw exists in how the WINS protocol handlers process incoming network packets—certain request types lack proper validation, enabling an attacker to send specially crafted UDP packets that trigger a NULL pointer dereference and service denial. No authentication or user interaction is required; an attacker on the network can exploit this remotely.

• CVE-2026-37226HIGH 7.5

  FlexRIC v2.0.0 contains a denial-of-service vulnerability in its iApp component. When the application receives a subscription request referencing an E2 Node that doesn't exist in the system, it crashes instead of handling the invalid reference gracefully. An attacker on the network can trigger this crash by sending a specially crafted request, causing the iApp process to go offline and disrupting O-RAN operations.

• CVE-2026-37230HIGH 7.5

  FlexRIC v2.0.0, an open RAN (O-RAN) near-real-time RIC (intelligent controller), crashes when it receives a RIC_INDICATION message with an invalid ran_func_id—a function identifier that doesn't exist in its internal registry. An unauthenticated attacker on the network can trigger this crash by sending a specially crafted message to port 36421, causing either an assertion failure in debug builds or a segmentation fault in release builds. This is a denial-of-service vulnerability that can disrupt RAN management and orchestration.

• CVE-2026-42764HIGH 7.5

  OpenSSL's QUIC server implementation contains a flaw that can crash the server when it receives specially crafted initial connection packets. This only affects servers that have explicitly disabled address validation—a non-default setting. An unauthenticated attacker on the network can exploit this by sending a QUIC initial packet with an invalid token, causing the server process to terminate abruptly and become unavailable. The vulnerability does not lead to data theft or unauthorized access, only service disruption.

• CVE-2026-42765HIGH 7.5

  CVE-2026-42765 is a denial-of-service vulnerability in OpenSSL that crashes applications when two specific certificate verification features are enabled simultaneously. The flaw occurs when OCSP response checking for the entire certificate chain is combined with partial-chain verification, and the chain lacks a self-signed trusted root certificate. Under these conditions, the code attempts to dereference a NULL pointer, causing the application to crash. Since both features are disabled by default in OpenSSL, real-world risk is limited to applications that explicitly enable both flags.

• CVE-2026-46110HIGH 7.5

  CVE-2026-46110 is a NULL pointer dereference vulnerability in the Linux kernel's stmmac network driver that can crash a system when memory becomes exhausted during packet reception. The driver manages a circular ring of descriptors to coordinate DMA transfers between the CPU and network hardware. When the driver runs out of memory to allocate new receive buffers, it can incorrectly process already-used descriptors as if they were fresh, leading to a kernel panic. This occurs because the driver doesn't properly distinguish between descriptors that are waiting to be refilled versus those that have already been processed.

• CVE-2026-46114HIGH 7.5

  A memory leak vulnerability exists in the Linux kernel's RDMA over Converged Ethernet (RoCE) driver. An attacker on the network can send specially crafted RDMA ATOMIC_WRITE requests with zero-length payloads to trigger the responder into reading uninitialized kernel memory and inadvertently leaking it back to the attacker. The vulnerability specifically affects how the kernel validates packet lengths before dereferencing memory, allowing 8 bytes of sensitive kernel data (including kernel strings and pointer information) to be extracted per malicious probe.

• CVE-2026-46527HIGH 7.5

  cpp-httplib versions before 0.44.0 crash when a trusted proxy configuration is enabled and an attacker sends a specially crafted X-Forwarded-For header that contains no parseable IP addresses. The crash results from the library attempting to access an empty data structure without bounds checking, causing the application to terminate abnormally. This is a denial-of-service vulnerability affecting only deployments that have explicitly configured trusted proxies.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-42903MEDIUM 6.5

  A flaw in Windows Kerberos authentication can be triggered by an authorized network user to crash or hang critical services. The vulnerability requires valid domain credentials to exploit, limiting its attack surface to insider threats or compromised accounts within an organization. While it does not expose data or allow privilege escalation, denial-of-service impact can disrupt authentication infrastructure and dependent business operations.

• CVE-2026-11788MEDIUM 5.9

  A vulnerability exists in 389 Directory Server where the dereference control plugin fails to verify that memory allocation succeeded before proceeding. An attacker on the network can trigger memory exhaustion conditions to crash the LDAP server without providing credentials. The attack requires specific environmental conditions (system memory pressure) to succeed, but no authentication is required.

• CVE-2026-42766MEDIUM 5.9

  A flaw in OpenSSL's CMS (Cryptographic Message Syntax) password decryption logic allows an attacker to crash applications by sending specially crafted encrypted messages. The vulnerability stems from the code not properly checking whether an optional field exists before using it, resulting in a null pointer crash and service disruption.

• CVE-2026-42767MEDIUM 5.9

  An OpenSSL vulnerability allows an attacker controlling or intercepting CMP (Certificate Management Protocol) traffic to crash client applications by sending a specially crafted certificate response. The attack exploits a code defect where OpenSSL fails to properly validate a specific field in the response, causing the application to crash and become unavailable. This is a denial-of-service issue, not a data breach or unauthorized access risk.

• CVE-2025-60481MEDIUM 5.5

  GPAC Project's MP4Box, a widely-used multimedia framework and command-line tool, contains a flaw in how it processes AC4 audio configuration data within media files. When a specially crafted AC4 file is opened, the application crashes due to a null pointer dereference—essentially trying to access memory that hasn't been properly initialized. This is a local denial-of-service vulnerability that requires user interaction (opening the malicious file) but could disrupt workflows involving media processing or transcoding pipelines.

• CVE-2025-60483MEDIUM 5.5

  A flaw in GPAC Project/MP4Box's AC4 audio file parser can crash the application when processing a specially crafted audio file. An attacker would need to trick a user into opening a malicious AC4 file, causing the service to stop responding. This is a moderate-risk issue affecting organizations that rely on MP4Box for media processing or transcoding workflows.

• CVE-2025-60485MEDIUM 5.5

  CVE-2025-60485 is a memory safety flaw in GPAC's MP4Box tool that causes the application to crash when processing a specially crafted MP4 media file. An attacker can exploit this by distributing a malicious MP4 that triggers the crash, disrupting service for anyone using MP4Box to process or analyze video files. The vulnerability requires local access and user interaction (opening or processing the file), so it is most relevant in environments where untrusted media files are routinely handled.

• CVE-2025-60495MEDIUM 5.5

  GPAC's MP4Box, a widely-used multimedia toolkit, contains a memory safety flaw in its color information parsing logic. When MP4Box processes a specially crafted media file, the vulnerable code attempts to access memory in an unsafe manner, causing the application to crash. An attacker with the ability to supply a malicious file to a user or system running MP4Box can trigger this denial of service. This is a local impact issue—it requires user interaction to open the file—but the barrier to exploitation is low.

• CVE-2025-71313MEDIUM 5.5

  A memory allocation failure in the Linux kernel's PCI endpoint driver could cause the system to crash. When the kernel tries to create a work queue for handling PCI endpoint-to-endpoint communication, it doesn't properly check whether that operation succeeded. If memory is scarce and the allocation fails, the driver continues anyway and later attempts to use the non-existent queue, triggering a NULL pointer dereference that halts the affected system. The fix is straightforward: check whether the allocation succeeded before proceeding.

• CVE-2026-46118MEDIUM 5.5

  A flaw in the Linux kernel's PAPR hypervisor pipe driver can cause the kernel to crash when attempting to create a device handle. The issue stems from a recent code refactoring that changed how the driver manages memory allocation and cleanup. When the driver tries to reuse a data structure after it has been cleared, the kernel attempts to access invalid memory, leading to a null pointer dereference and system panic. An unprivileged local user with ioctl access can trigger this crash, resulting in a denial of service.

• CVE-2026-46127MEDIUM 5.5

  A local memory safety issue exists in the Linux kernel's RDMA over Converged Ethernet (OCRDMA) driver. During certain error conditions in the protection domain setup function, the code attempts to dereference a null pointer instead of using a valid reference, potentially crashing the system. The vulnerability requires local access and specific user privileges to trigger, making it a moderate-severity issue affecting system stability rather than confidentiality or integrity.

• CVE-2026-46134MEDIUM 5.5

  A Linux kernel vulnerability in the Chrome OS Embedded Controller (cros_ec) Thunderbolt registration code fails to initialize a mutex lock, causing the system to crash when the uninitialized lock is later accessed. This affects devices that use the affected kernel code path during Thunderbolt device registration and mode switching. An unprivileged local user can trigger the crash by interacting with Thunderbolt/USB-C functionality, resulting in a denial of service.

• CVE-2026-46188MEDIUM 5.5

  A flaw exists in the Linux kernel's Cavium Octeon EP VF driver where a memory allocation function can fail but the code doesn't check for failure. When this happens, the driver tries to use the failed allocation as if it were valid, causing the system to crash. This is a local issue requiring user-level access to trigger.

• CVE-2026-46211MEDIUM 5.5

  A flaw in the Linux kernel's graphics driver (msm/gem) causes an ioctl function to report success even when it fails. When userspace attempts to retrieve metadata about graphics objects, the function incorrectly returns 0 (success) even if the underlying operations—such as copying data to userspace or allocating memory—actually fail. Additionally, if memory allocation fails, the code does not check for a NULL pointer, leading to a crash. This allows applications to think they've successfully retrieved metadata when they haven't, or to trigger a denial of service.

• CVE-2026-46216MEDIUM 5.5

  A flaw in the Linux kernel's GPU driver for Intel Arc graphics allows a local attacker with basic user privileges to crash the system. The vulnerability occurs when certain GPU components (specifically the media GT) are disabled through system configuration. Under these conditions, the driver attempts to access memory that hasn't been allocated, causing a kernel panic. An attacker with local access can trigger this crash, resulting in a denial of service. This is a localized memory safety issue that requires local access to exploit.

• CVE-2026-46222MEDIUM 5.5

  A flaw exists in the Linux kernel's Rockchip RKCam Interface (rkcif) media driver where certain data connection points (pads) lack proper validation checks. When a video stream is started on a device where these pads are not correctly connected, the kernel attempts to access memory that doesn't exist, causing the system to crash. This is a local issue—only users with login access to the affected system can trigger it, typically through video application commands.

• CVE-2026-46233MEDIUM 5.5

  A flaw in the Linux kernel's Batman-adv bridge loop avoidance (BLA) subsystem can cause a crash when the system attempts to clean up stale network bridge claims. The issue occurs because the cleanup routine doesn't properly check whether a claim is still valid before trying to access it, potentially leading to a null pointer dereference. An attacker with local access could trigger this condition to cause a denial of service.

• CVE-2026-46235MEDIUM 5.5

  The Linux kernel's saa7164 media driver failed to properly validate whether memory mapping operations succeeded before using the results. When the kernel tries to map I/O memory regions for certain hardware (specifically PCI base address registers 0 and 2), it could receive a null pointer if the operation failed. The driver would then attempt to use these null pointers, causing a system crash. This patch adds defensive checks: if memory mapping fails, the driver now properly cleans up any partially allocated resources and safely reports an error instead of proceeding with unusable pointers.

• CVE-2026-46245MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver (amdgpu) can cause a system crash when the driver attempts to initialize Hot Plug Detect (HPD) interrupts for video connectors. The problem occurs because the code checks whether a connector's data structure (dc_link) is valid in one place, but then later uses it without checking again, leading to a null pointer dereference. This vulnerability affects systems with AMD GPUs running vulnerable kernel versions and can be triggered by a local user, resulting in a denial of service.

• CVE-2026-46258MEDIUM 5.5

  A flaw in the Linux kernel's GPIO character device (cdev) interface causes the system to crash when creating a line handle. The issue occurs because code attempts to use a pointer after it has been intentionally cleared to NULL, leading to a crash when the kernel tries to access memory through that invalid pointer. This is a local issue—an authenticated user on the system would need to trigger it, typically through ioctl calls to the GPIO device.

• CVE-2026-46261MEDIUM 5.5

  A vulnerability in the Linux kernel's SPI WPC flash interface unit driver can cause the system to crash due to a missing safety check. When the driver initializes, it attempts to access memory resources without first verifying they exist, potentially leading to a NULL pointer dereference that brings down the affected process or system. This is a localized denial-of-service issue requiring local system access to trigger.

• CVE-2026-46269MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's Canaan K230 pinctrl driver. During device initialization, the driver attempts to access a device structure through an uninitialized pointer, causing the kernel to crash. The issue occurs because the code tries to retrieve the device reference via a control structure that hasn't been set up yet. An attacker with local access could trigger this crash by loading the affected driver or probing the device, leading to a denial of service.

• CVE-2026-46278MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Imagination PowerVR graphics driver. When a local user attempts to update ftrace debug settings through a debugfs interface, the driver passes incorrect data to the operation, causing the kernel to crash. This is a stability issue rather than a data breach or privilege escalation risk—an authenticated local user can trigger a denial of service condition.

• CVE-2026-46282MEDIUM 5.5

  A flaw in the Linux kernel's admv1013 frequency driver can cause the system to crash or become unresponsive. The vulnerability occurs when the driver fails to properly read a configuration setting from the device, but then tries to use that uninitialized data anyway, leading to a null pointer dereference. An unprivileged local user with access to the affected system could trigger this condition to cause a denial of service.

• CVE-2026-46284MEDIUM 5.5

  A defect in the Linux kernel's hugepages parameter parsing can cause the system to crash during early boot if certain kernel command-line parameters are malformed. Specifically, if hugepages, hugepagesz, or default_hugepagesz parameters are supplied without an equals sign (e.g., 'hugepages 1G' instead of 'hugepages=1G'), the kernel's early parameter handler passes a NULL pointer to the hugetlb_add_param() function, which then crashes when attempting to measure the string length. The fix validates input before processing and rejects malformed parameters gracefully.

• CVE-2026-46296MEDIUM 5.5

  A bug in the Linux kernel's SPI driver for Samsung S3C64xx controllers can crash the system when the driver is unloaded. The issue stems from incomplete refactoring: code that allocates DMA channels was moved from initialization to a later setup phase, but the corresponding cleanup code was not removed from the driver shutdown process. When the driver unloads, it tries to release DMA resources that were never allocated, triggering a NULL-pointer crash.

• CVE-2026-46305MEDIUM 5.5

  A flaw in the Linux kernel's rtl8723bs WiFi driver can cause the system to crash if memory allocation fails during buffer initialization. When the driver attempts to create a buffer, it doesn't properly check whether the memory allocation succeeded before trying to use it. If the allocation fails—a condition that may occur under memory pressure—the code will attempt to access a NULL pointer, causing a denial of service. This is a localized driver issue affecting WiFi functionality rather than a system-wide kernel compromise.

• CVE-2026-46310MEDIUM 5.5

  A flaw in the Linux kernel's Renesas VSP1 media driver causes a system crash when the module is unloaded on certain hardware generations. The bug stems from cleanup code calling the wrong function variant, leaving a dangling pointer that triggers a crash. This affects local users with module unload privileges and requires a kernel patch to resolve.

• CVE-2026-46313MEDIUM 5.5

  A flaw exists in the Linux kernel's Intel IPU6 media driver where an error-handling code path incorrectly dereferences a pointer that has been marked as invalid (an error pointer). When the driver encounters certain initialization failures during PCI device probing, it attempts to clean up resources but doesn't properly null-check a pointer before using it, leading to a kernel crash. This is a local denial-of-service issue affecting systems running vulnerable kernel versions with the Intel IPU6 driver enabled.

• CVE-2026-47335MEDIUM 5.5

  Ubuntu Linux kernel version 6.8 contains a defect in how it handles AppArmor security notifications. An unprivileged local user can trigger a NULL pointer dereference—a programming error where the kernel tries to access memory that doesn't exist—causing the entire system to crash. This is a local denial-of-service vulnerability; it does not allow data theft or privilege escalation, but it can disrupt service availability.

• CVE-2025-60477MEDIUM 5.0

  CVE-2025-60477 is a crash vulnerability in GPAC's MP4Box multimedia processing tool. A specially crafted file can trigger a program crash when processed by a local or authenticated user, disrupting media encoding and processing workflows. The vulnerability does not leak data or enable privilege escalation, but it can be weaponized to interrupt legitimate operations or degrade service availability.

• CVE-2026-45729MEDIUM 4.3

  ThorVG, a vector graphics rendering engine, contains a flaw that can crash applications using it when they process malicious SVG files. An attacker can craft a specially formatted SVG document as small as 6 bytes that triggers an application crash when the affected code path is invoked. This is a denial-of-service vulnerability affecting availability but not data confidentiality or integrity. The issue was introduced in earlier versions and is resolved in ThorVG 1.0.5.

• CVE-2026-28581MEDIUM 4.0

  A logic error in Android's call processing code allows an application to initiate emergency calls without proper authorization checks. The vulnerability stems from inadequate validation in the CallIntentProcessor when determining the initiating user, potentially enabling an app to trigger emergency dialing functionality that should be restricted. No user interaction is required for exploitation, and the issue affects multiple Android versions.

• CVE-2026-10197LOW 3.3

  Assimp, a widely-used open-source 3D model import library, contains a flaw in its glTF2 file handler that can cause the application to crash when processing maliciously crafted glTF2 files with embedded textures. An attacker with local file system access can trigger a null pointer dereference by supplying a crafted glTF2 file, leading to denial of service. The vulnerability affects versions up to and including 6.0.4. A fix exists in pending pull request form but has not yet been merged into a stable release.

• CVE-2026-10198LOW 3.3

  Assimp, a popular open-source 3D model import library, contains a flaw in its glTF file import handler that can cause the application to crash. The vulnerability stems from improper handling of certain glTF mesh data, leading to a null pointer dereference when the ImportMeshes function processes malformed or specially crafted files. An attacker with local access to a system running a vulnerable version of Assimp could trigger this crash, resulting in denial of service. The issue affects Assimp versions up to and including 6.0.4.

• CVE-2026-10199LOW 3.3

  Assimp, a popular 3D asset library, contains a null pointer dereference vulnerability in its glTF2 parsing code. An attacker with local access can craft a malicious glTF2 file that triggers a crash when processed, causing a denial of service. The vulnerability affects Assimp versions up to 6.0.4 and has been publicly disclosed, though it requires local interaction and low privileges to exploit.

• CVE-2026-10298LOW 3.3

  A null pointer dereference vulnerability exists in whisper.cpp versions up to 1.8.2, specifically in the model loading function. An attacker with local system access can trigger this flaw to cause the application to crash or become unavailable. The vulnerability requires user privileges to exploit and does not directly compromise data confidentiality or integrity. Public exploit code is available, though the impact remains limited to denial of service on the affected system.

• CVE-2026-47327LOW 3.3

  CVE-2026-47327 is a denial-of-service vulnerability in Ubuntu Linux affecting versions 6.8, 6.17, and 7.0. A NULL pointer dereference in the AppArmor notification handling code allows any unprivileged local user to crash the kernel without authentication or special permissions. The attack requires only local system access and can be triggered with a single action, causing a kernel oops that disrupts availability but does not compromise confidentiality or integrity.

• CVE-2026-47337LOW 3.3

  A NULL pointer dereference flaw in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 can be triggered by any unprivileged local user to crash the kernel. The vulnerability exists in socket mediation code that handles both IPv4 and IPv6 traffic. While the flaw itself does not enable data theft or system compromise, it can be exploited to cause a denial of service by forcing a kernel panic, disrupting availability for all users on the affected system.