Common Weakness Enumeration

CWE-476

Weakness Allowed

NULL Pointer Dereference

Abstraction: Base · Status: Stable

API response cwe.mitre.org

The product dereferences a pointer that it expects to be valid but is NULL.

Dimensions

Behavior-Type: Dereferenc
Resource-Type: Pointer
Resource-Property: NULL

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-710 · View CWE-1000

ChildOf: CWE-754 · View CWE-1000

ChildOf: CWE-754 · View CWE-1003

Modes of introduction

Implementation

Detection methods

Automated Dynamic Analysis

This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Effectiveness: Moderate

Manual Dynamic Analysis

Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services such as DNS. Monitor the software for any unexpected behavior. If you trigger an unhandled exception or similar error that was discovered and handled by the application's environment, it may still indicate unexpected conditions that were not handled by the application itself.

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Effectiveness: Moderate

Crafted inputs are necessary to reach the code containing the error, such as generated by fuzzers. Also, these tools may reduce performance, and they only report the error condition - not the original mistake that led to the error.

Content history

Submission: 7 Pernicious Kingdoms · 2006-07-19 · CWE Draft 3

Contribution: Abhi Balakrishnan · 2024-02-29 · CWE 4.15

Provided diagram to improve CWE usability

Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Time_of_Introduction

Modification: · KDM Analytics · 2008-08-01 · CWE 1.0

added/updated white box definitions

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2008-11-24 · CWE 1.1

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2009-05-27 · CWE 1.4

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2009-10-29 · CWE 1.6

updated Relationships

Modification: CWE Content Team · MITRE · 2009-12-28 · CWE 1.7

updated Common_Consequences, Demonstrative_Examples, Other_Notes, Potential_Mitigations, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2010-02-16 · CWE 1.8

updated Potential_Mitigations, Relationships

Modification: CWE Content Team · MITRE · 2010-06-21 · CWE 1.9

updated Demonstrative_Examples, Description, Detection_Factors, Potential_Mitigations

Modification: CWE Content Team · MITRE · 2010-09-27 · CWE 1.10

updated Demonstrative_Examples, Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2010-12-13 · CWE 1.11

updated Relationships

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2011-06-27 · CWE 2.0

updated Related_Attack_Patterns, Relationships

Modification: CWE Content Team · MITRE · 2011-09-13 · CWE 2.1

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Observed_Examples, Related_Attack_Patterns, Relationships

Modification: CWE Content Team · MITRE · 2014-02-18 · CWE 2.6

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2015-12-07 · CWE 2.9

updated Relationships

Modification: CWE Content Team · MITRE · 2017-01-19 · CWE 2.10

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Relationships, Taxonomy_Mappings, White_Box_Definitions

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated Relationships

Modification: CWE Content Team · MITRE · 2019-06-20 · CWE 3.3

updated Relationships

Modification: CWE Content Team · MITRE · 2019-09-19 · CWE 3.4

updated References, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated References

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Relationships

Modification: CWE Content Team · MITRE · 2021-03-15 · CWE 4.4

updated Demonstrative_Examples, Observed_Examples

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Relationships

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Alternate_Terms

Modification: CWE Content Team · MITRE · 2022-06-28 · CWE 4.8

updated Relationships

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Alternate_Terms, Applicable_Platforms, Observed_Examples

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Demonstrative_Examples, Detection_Factors, References, Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes, Relationships

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2024-07-16 · CWE 4.15

updated Alternate_Terms, Demonstrative_Examples, Description, Diagram, Potential_Mitigations, Relationships, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2024-11-19 · CWE 4.16

updated Relationships

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Demonstrative_Examples, Potential_Mitigations

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Potential_Mitigations, References

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Detection_Factors, Observed_Examples, References, Relationships

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Applicable_Platforms, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings

7138 vulnerabilities reference this CWE, most recent first.

CVE-2026-125334 (GCVE-0-2026-125334)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:49 – Updated: 2026-11-10 18:49

Title

Forge: TLS client crash on a handshake record received without a session

Summary

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/digitalbazaar/forge/security/a…	x_refsource_CONFIRM
https://github.com/digitalbazaar/forge/pull/1169	x_refsource_MISC
https://github.com/digitalbazaar/forge/commit/2cf…	x_refsource_MISC
https://github.com/digitalbazaar/forge/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
digitalbazaar	forge	Affected: < 1.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify alert, after the application calls close(), or before handshake() is called. The handler dereferences c.session.md5 before dispatching the message, causing a TypeError to propagate from connection.process(). A malicious server or on-path attacker can deliver the record, including after a reset when the connection uses no encryption, and terminate a Node.js process if the application does not catch the exception. forge.tls servers are not affected, and there is no confidentiality or integrity impact. This issue is fixed in version 1.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:49:55.508Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/pull/1169",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/pull/1169"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"
        }
      ],
      "source": {
        "advisory": "GHSA-j8rw-jp99-435v",
        "discovery": "UNKNOWN"
      },
      "title": "Forge: TLS client crash on a handshake record received without a session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125334",
    "datePublished": "2026-11-10T18:49:55.508Z",
    "dateReserved": "2026-11-09T21:22:55.598Z",
    "dateUpdated": "2026-11-10T18:49:55.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125231 (GCVE-0-2026-125231)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 21:06

Title

FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()

Summary

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 20:57 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

5 references

URL	Tags
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703	issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/515dcad73…	patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba…	technical-description
https://github.com/FFmpeg/FFmpeg	product
https://www.vulncheck.com/advisories/ffmpeg-4.4-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FFmpeg	FFmpeg	Affected: 4.4 , ≤ 9.0.2 (custom) cpe:2.3:a:ffmpeg:ffmpeg::::::::

Date Public

2026-11-03 00:00

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:57:57.261031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:06:54.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "4.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michael Niedermayer"
        }
      ],
      "datePublic": "2026-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx_decode_header() updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample rate, causing adx_decode() to write through NULL plane pointers and crash the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:11:43.003Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/515dcad73d77711507083cae3913c9327c0977c6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/adxdec.c#L77"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-null-pointer-dereference-via-adx-decode-header"
        }
      ],
      "title": "FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125231",
    "datePublished": "2026-11-09T19:11:43.003Z",
    "dateReserved": "2026-11-09T18:15:23.272Z",
    "dateUpdated": "2026-11-09T21:06:54.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125216 (GCVE-0-2026-125216)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 21:06

Title

FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()

Summary

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 21:00 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

5 references

URL	Tags
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690	issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/aa5fd7d28…	patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba…	technical-description
https://github.com/FFmpeg/FFmpeg	product
https://www.vulncheck.com/advisories/ffmpeg-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FFmpeg	FFmpeg	Affected: 0 , ≤ 9.0.2 (semver) cpe:2.3:a:ffmpeg:ffmpeg::::::::

Date Public

2026-11-02 00:00

Credits

Joshua Rogers (AISLE Research) Michael Niedermayer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:00:03.624152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:06:55.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michael Niedermayer"
        }
      ],
      "datePublic": "2026-11-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bits_per_raw_sample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encode_gbrp12() and dereferences NULL plane pointers, causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:11:31.681Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/aa5fd7d287db4f469fdcbe444f7f9f38c8c289c7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dpxenc.c#L72"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dpx-encoder-null-pointer-dereference-via-encode-gbrp12"
        }
      ],
      "title": "FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125216",
    "datePublished": "2026-11-09T19:11:31.681Z",
    "dateReserved": "2026-11-09T18:15:17.666Z",
    "dateUpdated": "2026-11-09T21:06:55.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125215 (GCVE-0-2026-125215)

Vulnerability from cvelistv5 – Published: 2026-11-09 19:11 – Updated: 2026-11-09 21:06

Title

FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

Summary

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 21:00 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

7 references

URL	Tags
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24514	issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25606	issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/971ea9d6a…	patch
https://github.com/FFmpeg/FFmpeg/commit/11c4b4201…	patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba…	technical-description
https://github.com/FFmpeg/FFmpeg	product
https://www.vulncheck.com/advisories/ffmpeg-7.1-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FFmpeg	FFmpeg	Affected: 7.1 , ≤ 9.0.2 (custom) cpe:2.3:a:ffmpeg:ffmpeg::::::::

Date Public

2026-09-15 00:00

Credits

Zheng Yu @ Depthfirst Joshua Rogers (AISLE Research) Michael Niedermayer Kacper Michajłow

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:00:19.670973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:06:56.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThanOrEqual": "9.0.2",
              "status": "affected",
              "version": "7.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "9.0.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zheng Yu @ Depthfirst"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Joshua Rogers (AISLE Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michael Niedermayer"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kacper Michaj\u0142ow"
        }
      ],
      "datePublic": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:11:30.975Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24514"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25606"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/971ea9d6a2a9ae4c770936f0569cf40720d4c304"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/11c4b420183cb2d6cd4afaa53de57d400a45e09e"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dovi_rpuenc.c#L741"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-7.1-through-9.0.2-null-pointer-dereference-via-ff-dovi-rpu-generate"
        }
      ],
      "title": "FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125215",
    "datePublished": "2026-11-09T19:11:30.975Z",
    "dateReserved": "2026-11-09T18:15:17.327Z",
    "dateUpdated": "2026-11-09T21:06:56.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125107 (GCVE-0-2026-125107)

Vulnerability from cvelistv5 – Published: 2026-11-09 21:29 – Updated: 2026-11-10 16:13

Title

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Summary

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 16:12 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/julianhille/MuhammaraJS/securi…	x_refsource_CONFIRM
https://github.com/julianhille/MuhammaraJS/commit…	x_refsource_MISC
https://github.com/julianhille/MuhammaraJS/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
julianhille	MuhammaraJS	Affected: < 6.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125107",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T16:12:53.511568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T16:13:16.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MuhammaraJS",
          "vendor": "julianhille",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:29:35.198Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"
        },
        {
          "name": "https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b"
        },
        {
          "name": "https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/julianhille/MuhammaraJS/releases/tag/6.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-fhp4-pr5j-46m5",
        "discovery": "UNKNOWN"
      },
      "title": "Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125107",
    "datePublished": "2026-11-09T21:29:35.198Z",
    "dateReserved": "2026-11-09T17:45:35.935Z",
    "dateUpdated": "2026-11-10T16:13:16.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124311 (GCVE-0-2026-124311)

Vulnerability from cvelistv5 – Published: 2026-11-07 14:17 – Updated: 2026-11-09 22:41

Title

Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk

Summary

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:35 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/fraunhoferhhi/vvdec/issues/420	issue-tracking
https://github.com/fraunhoferhhi/vvdec/commit/fb7…	patch
https://github.com/fraunhoferhhi/vvdec/blob/v3.2.…	technical-description
https://github.com/fraunhoferhhi/vvdec	product
https://www.vulncheck.com/advisories/fraunhofer-h…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
fraunhoferhhi	vvdec	Affected: 0 , ≤ 3.2.1 (semver)

Date Public

2026-10-12 00:00

Credits

Alexander A. Shvedov (sigdevel)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:05:22.662Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/09/22"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:35:20.962453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:41:29.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/fraunhoferhhi/vvdec",
          "product": "vvdec",
          "repo": "https://github.com/fraunhoferhhi/vvdec",
          "vendor": "fraunhoferhhi",
          "versions": [
            {
              "lessThanOrEqual": "3.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander A. Shvedov (sigdevel)"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with sps_ref_wraparound_enabled_flag set, causing reads from missing PIC_RECON_WRAP buffers and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T14:17:53.095Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/issues/420"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/commit/fb73aca37b48f89814f57edbc8072a37d47bbe06"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec/blob/v3.2.1/source/Lib/CommonLib/InterPrediction.cpp#L790-L796"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fraunhoferhhi/vvdec"
        },
        {
          "name": "VulnCheck Advisory: Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-through-3.2.1-null-pointer-dereference-via-interprediction-xpredinterblk"
        }
      ],
      "title": "Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124311",
    "datePublished": "2026-11-07T14:17:53.095Z",
    "dateReserved": "2026-11-07T12:24:20.197Z",
    "dateUpdated": "2026-11-09T22:41:29.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123507 (GCVE-0-2026-123507)

Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37

Title

Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

Summary

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/go-vikunja/vikunja/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/vikunja-0.24…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
go-vikunja	vikunja	Affected: 0.24.0 , < 2.7.1 (semver) Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja::::::::

Date Public

2026-10-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/code.vikunja.io/api",
          "product": "vikunja",
          "vendor": "go-vikunja",
          "versions": [
            {
              "lessThan": "2.7.1",
              "status": "affected",
              "version": "0.24.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.7.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.7.1",
                  "versionStartIncluding": "0.24.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T01:37:21.778Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hm4w-h7v8-ch43)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hm4w-h7v8-ch43"
        },
        {
          "name": "VulnCheck Advisory: Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vikunja-0.24.0-before-2.7.1-denial-of-service-via-nil-bucket-filter"
        }
      ],
      "title": "Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123507",
    "datePublished": "2026-11-08T01:37:21.778Z",
    "dateReserved": "2026-11-06T00:46:28.480Z",
    "dateUpdated": "2026-11-08T01:37:21.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123492 (GCVE-0-2026-123492)

Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-09 22:45

Title

SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

Summary

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:34 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7784 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/siyuan-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: 0 , < 3.8.9 (semver) Unaffected: 3.8.9 (semver) cpe:2.3:a:b3log:siyuan::::::::

Date Public

2026-10-22 00:00

Credits

xy3xy3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:34:36.965659Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:45:47.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "lessThan": "3.8.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.8.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.8.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "xy3xy3"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T15:00:52.853Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2x3p-x74g-442x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2x3p-x74g-442x"
        },
        {
          "name": "VulnCheck Advisory: SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.9-nil-pointer-dereference-dos-via-mcp-resources-read"
        }
      ],
      "title": "SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123492",
    "datePublished": "2026-11-06T15:00:52.853Z",
    "dateReserved": "2026-11-06T00:44:37.659Z",
    "dateUpdated": "2026-11-09T22:45:47.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-122194 (GCVE-0-2026-122194)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:21 – Updated: 2026-11-10 21:11

Title

Microsoft Defender Remote Code Execution Vulnerability

Summary

Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 21:07 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 4930 records in the last 180 days details

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
Microsoft	Microsoft Malware Protection Engine	Affected: 1.1.0.0 , < 1.1.26100.4 (custom) cpe:2.3:a:microsoft:malware_protection_engine::::::::

Date Public

2026-11-10 16:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:07:33.865115Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:11:13.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Malware Protection Engine",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.1.26100.4",
              "status": "affected",
              "version": "1.1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.1.26100.4",
                  "versionStartIncluding": "1.1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T19:42:15.338Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Defender Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122194"
        }
      ],
      "title": "Microsoft Defender Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-122194",
    "datePublished": "2026-11-10T18:21:58.966Z",
    "dateReserved": "2026-11-04T20:00:16.385Z",
    "dateUpdated": "2026-11-10T21:11:13.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121522 (GCVE-0-2026-121522)

Vulnerability from cvelistv5 – Published: 2026-11-03 22:09 – Updated: 2026-11-06 19:31

Title

Possible panic from Git source resolver

Summary

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Severity

6.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:31 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Docker CNA under the mitre root

CNA scorecard B 88/100 over 45 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/moby/buildkit/security/advisor…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
moby	BuildKit	Affected: 0.26.0 , < 0.34.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121522",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:31:23.734747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:31:52.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/moby/buildkit",
          "product": "BuildKit",
          "vendor": "moby",
          "versions": [
            {
              "lessThan": "0.34.2",
              "status": "affected",
              "version": "0.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Attacker-controlled build input processed by a user"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T22:09:29.028Z",
        "orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
        "shortName": "Docker"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade BuildKit to v0.34.2 or later."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Possible panic from Git source resolver",
      "workarounds": [
        {
          "lang": "en",
          "value": "Avoid untrusted build definitions. Only specific builds using Git dependencies trigger this issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
    "assignerShortName": "Docker",
    "cveId": "CVE-2026-121522",
    "datePublished": "2026-11-03T22:09:29.028Z",
    "dateReserved": "2026-11-03T14:27:34.585Z",
    "dateUpdated": "2026-11-06T19:31:52.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation MIT-56

Implementation

For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].

Mitigation

Requirements

Select a programming language that is not susceptible to these issues.

Mitigation

Implementation

Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

Mitigation

Architecture and Design

Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.

Mitigation

Implementation

Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list