CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6922 vulnerabilities reference this CWE, most recent first.
GHSA-R9V4-XQJF-V9M3
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-10-13 15:31In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
When sfb has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (sfb in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(sfb) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (sfb). And herein lies the problem. - sfb will call the child's dequeue() which will essentially just try to grab something of qfq's queue.
[ 127.594489][ T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 127.594741][ T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full) [ 127.595059][ T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 127.595254][ T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq] [ 127.595461][ T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b [ 127.596081][ T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216 [ 127.596337][ T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000 [ 127.596623][ T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0 [ 127.596917][ T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3 [ 127.597165][ T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000 [ 127.597404][ T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000 [ 127.597644][ T453] FS: 00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000 [ 127.597956][ T453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 127.598160][ T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0 [ 127.598390][ T453] PKRU: 55555554 [ 127.598509][ T453] Call Trace: [ 127.598629][ T453] [ 127.598718][ T453] ? mark_held_locks+0x40/0x70 [ 127.598890][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599053][ T453] sfb_dequeue+0x88/0x4d0 [ 127.599174][ T453] ? ktime_get+0x137/0x230 [ 127.599328][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599480][ T453] ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq] [ 127.599670][ T453] ? srso_alias_return_thunk+0x5/0xfbef5 [ 127.599831][ T453] tbf_dequeue+0x6b1/0x1098 [sch_tbf] [ 127.599988][ T453] __qdisc_run+0x169/0x1900
The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead.
{
"affected": [],
"aliases": [
"CVE-2026-64012"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:41Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nWhen sfb has children (eg qfq qdisc) whose peek() callback is\nqdisc_peek_dequeued(), we could get a kernel panic. When the parent of such\nqdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from\nits child (sfb in this case), it will do the following:\n 1a. do a peek() - and when sensing there\u0027s an skb the child can offer, then\n - the child in this case(sfb) calls its child\u0027s (qfq) peek.\n qfq does the right thing and will return the gso_skb queue packet.\n Note: if there wasnt a gso_skb entry then qfq will store it there.\n 1b. invoke a dequeue() on the child (sfb). And herein lies the problem.\n - sfb will call the child\u0027s dequeue() which will essentially just\n try to grab something of qfq\u0027s queue.\n\n[ 127.594489][ T453] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]\n[ 127.594741][ T453] CPU: 2 UID: 0 PID: 453 Comm: ping Not tainted 7.1.0-rc1-00035-gac961974495b-dirty #793 PREEMPT(full)\n[ 127.595059][ T453] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 127.595254][ T453] RIP: 0010:qfq_dequeue+0x35c/0x1650 [sch_qfq]\n[ 127.595461][ T453] Code: 00 fc ff df 80 3c 02 00 0f 85 17 0e 00 00 4c 8d 73 48 48 89 9d b8 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 76 0c 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b\n[ 127.596081][ T453] RSP: 0018:ffff88810e5af440 EFLAGS: 00010216\n[ 127.596337][ T453] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: dffffc0000000000\n[ 127.596623][ T453] RDX: 0000000000000009 RSI: 0000001880000000 RDI: ffff888104fd82b0\n[ 127.596917][ T453] RBP: ffff888104fd8000 R08: ffff888104fd8280 R09: 1ffff110211893a3\n[ 127.597165][ T453] R10: 1ffff110211893a6 R11: 1ffff110211893a7 R12: 0000001880000000\n[ 127.597404][ T453] R13: ffff888104fd82b8 R14: 0000000000000048 R15: 0000000040000000\n[ 127.597644][ T453] FS: 00007fc380cbfc40(0000) GS:ffff88816f2a8000(0000) knlGS:0000000000000000\n[ 127.597956][ T453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 127.598160][ T453] CR2: 00005610aa9890a8 CR3: 000000010369e000 CR4: 0000000000750ef0\n[ 127.598390][ T453] PKRU: 55555554\n[ 127.598509][ T453] Call Trace:\n[ 127.598629][ T453] \u003cTASK\u003e\n[ 127.598718][ T453] ? mark_held_locks+0x40/0x70\n[ 127.598890][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599053][ T453] sfb_dequeue+0x88/0x4d0\n[ 127.599174][ T453] ? ktime_get+0x137/0x230\n[ 127.599328][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599480][ T453] ? qdisc_peek_dequeued+0x7b/0x350 [sch_qfq]\n[ 127.599670][ T453] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 127.599831][ T453] tbf_dequeue+0x6b1/0x1098 [sch_tbf]\n[ 127.599988][ T453] __qdisc_run+0x169/0x1900\n\nThe right thing to do in #1b is to grab the skb off gso_skb queue.\nThis patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()\nmethod instead.",
"id": "GHSA-r9v4-xqjf-v9m3",
"modified": "2026-10-13T15:31:30Z",
"published": "2026-07-19T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64012"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R9V6-9429-66G9
Vulnerability from github – Published: 2025-11-25 18:32 – Updated: 2025-11-25 18:32NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-33197"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-25T18:15:51Z",
"severity": "MODERATE"
},
"details": "NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.",
"id": "GHSA-r9v6-9429-66g9",
"modified": "2025-11-25T18:32:23Z",
"published": "2025-11-25T18:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33197"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5720"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-33197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R9VW-9GVX-7G72
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against avahi-daemon via the D-Bus interface or a "ping .local" command.
{
"affected": [],
"aliases": [
"CVE-2021-36217"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T18:15:00Z",
"severity": "MODERATE"
},
"details": "Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against avahi-daemon via the D-Bus interface or a \"ping .local\" command.",
"id": "GHSA-r9vw-9gvx-7g72",
"modified": "2022-05-24T19:06:58Z",
"published": "2022-05-24T19:06:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36217"
},
{
"type": "WEB",
"url": "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188083"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RC25-XMW7-W43P
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-15 21:31A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. Processing web content may lead to a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2026-65412"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:24Z",
"severity": "MODERATE"
},
"details": "A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. Processing web content may lead to a denial-of-service.",
"id": "GHSA-rc25-xmw7-w43p",
"modified": "2026-09-15T21:31:06Z",
"published": "2026-09-14T21:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65412"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149034"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149038"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149041"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149042"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC56-W2J5-3X6Q
Vulnerability from github – Published: 2026-06-09 18:31 – Updated: 2026-06-09 18:31InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2026-34704"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T18:16:42Z",
"severity": "MODERATE"
},
"details": "InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-rc56-w2j5-3x6q",
"modified": "2026-06-09T18:31:03Z",
"published": "2026-06-09T18:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34704"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/indesign/apsb26-58.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC6F-9G56-MR6Q
Vulnerability from github – Published: 2022-08-29 20:06 – Updated: 2025-04-23 18:30A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-1199"
],
"database_specific": {
"cwe_ids": [
"CWE-416",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-29T15:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.",
"id": "GHSA-rc6f-9g56-mr6q",
"modified": "2025-04-23T18:30:35Z",
"published": "2022-08-29T20:06:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1199"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/4e0f718daf97d47cf7dec122da1be970f145c809"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/71171ac8eb34ce7fe6b3267dce27c313ab3cb3ac"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/7ec02f5ac8a5be5a3f20611731243dc5e1d9ba10"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-1199"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070694"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221228-0006"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/04/02/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC73-PC24-F3RR
Vulnerability from github – Published: 2022-05-14 01:29 – Updated: 2025-04-20 03:50In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.
{
"affected": [],
"aliases": [
"CVE-2017-17997"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-30T07:29:00Z",
"severity": "HIGH"
},
"details": "In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.",
"id": "GHSA-rc73-pc24-f3rr",
"modified": "2025-04-20T03:50:41Z",
"published": "2022-05-14T01:29:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17997"
},
{
"type": "WEB",
"url": "https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14299"
},
{
"type": "WEB",
"url": "https://code.wireshark.org/review/#/c/25063"
},
{
"type": "WEB",
"url": "https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=80a695869c9aef2fb473d9361da068022be7cb50"
},
{
"type": "WEB",
"url": "https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=80a695869c9aef2fb473d9361da068022be7cb50"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2018-02.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC74-9J9P-C3XP
Vulnerability from github – Published: 2025-05-08 09:30 – Updated: 2025-11-13 00:30In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix invalid pointer dereference in Etron workaround
This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called.
Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well.
Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result.
Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.
{
"affected": [],
"aliases": [
"CVE-2025-37813"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-08T07:15:52Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn\u0027t end well.\n\nUse a functionally equivalent test which doesn\u0027t dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied.",
"id": "GHSA-rc74-9j9p-c3xp",
"modified": "2025-11-13T00:30:16Z",
"published": "2025-05-08T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37813"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RC7M-H6PJ-RGG2
Vulnerability from github – Published: 2026-10-12 18:31 – Updated: 2026-10-12 18:31FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, causing client denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-109241"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T17:17:14Z",
"severity": "LOW"
},
"details": "FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-\u003egeometry, then send VideoData that dereferences it, causing client denial of service.",
"id": "GHSA-rc7m-h6pj-rgg2",
"modified": "2026-10-12T18:31:37Z",
"published": "2026-10-12T18:31:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v7-9jp5-wqj2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109241"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.0-null-dereference-in-video-redirection-channel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RC8V-WC74-5X2X
Vulnerability from github – Published: 2022-04-29 02:57 – Updated: 2024-02-16 00:30RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.
{
"affected": [],
"aliases": [
"CVE-2004-0389"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-06-01T04:00:00Z",
"severity": "HIGH"
},
"details": "RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.",
"id": "GHSA-rc8v-wc74-5x2x",
"modified": "2024-02-16T00:30:28Z",
"published": "2022-04-29T02:57:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0389"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15880"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/11395"
},
{
"type": "WEB",
"url": "http://www.idefense.com/application/poi/display?id=102\u0026type=vulnerabilities"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/10157"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.