CVE Database

CVE-2026-96850 Medium · 5.5 CWE-170 Oct 13, 2026

Windows Modern Device Management (MDM) Information Disclosure Vulnerability

Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.

CVE-2026-83781 High · 7.8 CWE-170 Oct 13, 2026

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

CVE-2026-78506 Medium · 5.5 CWE-170 Sep 8, 2026

Microsoft Office Word Information Disclosure Vulnerability

Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-70587 High · 7.5 CWE-170 Sep 8, 2026

Windows Remote Desktop Protocol Information Disclosure Vulnerability

Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.

CVE-2026-12386 Low · 3.9 CWE-170 Jul 5, 2026

Buffer Overflow in TUBITAK BILGEM's Pardus Pen

Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.

CVE-2026-8721 Critical · 9.8 CWE-170 May 17, 2026

Crypt::OpenSSL::PKCS12 for Perl: password truncation at embedded NULL bytes (CWE-170)

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

CVE-2026-42010 Critical · 9.8 CWE-170 May 7, 2026

Gnutls: gnutls: authentication bypass via nul character in username

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

CVE-2026-40334 Low · 3.5 CWE-170 Apr 17, 2026

libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.

CVE-2026-2239 Medium · 6.5 CWE-170 Mar 26, 2026

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Document) file. This occurs because the buffer allocated for a Pascal string is not properly null-terminated, leading to an out-of-bounds read when strlen() is subsequently called. Successfully exploiting this vulnerability can cause the application to crash, resulting in an application level Denial of Service.

CVE-2026-32837 Medium · 4.0 CWE-170 Mar 17, 2026

mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing

miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.

CVE-2026-23749 Low · 2.9 CWE-170 Feb 26, 2026

Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read

Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).

CVE-2025-2026 High · 7.1 CWE-170 Dec 31, 2025

The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability…

The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and result in a denial-of-service (DoS) condition. An authenticated remote attacker with web read-only privileges can exploit the vulnerable API to inject malicious input. Successful exploitation may cause the device to reboot, disrupting normal operations and causing a temporary denial of service.

CVE-2025-67790 High · 7.5 CWE-170 Dec 17, 2025

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1…

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.

CVE-2025-66220 High · 7.1 CWE-170 Dec 3, 2025

Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.