CVE-2026-21525
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
Medium
Known exploited
- Severity
- 6.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 4.87%
- Chance of exploitation in the next 30 days. Higher than 92.04% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Feb 10, 2026
- Weakness
- CWE-476 NULL Pointer Dereference
- Fix
- None yet
- No fixed version published
Exploited in the wild. Microsoft Windows NULL Pointer Dereference Vulnerability (Microsoft Windows). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Mar 3, 2026.
Description
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Requirements: Select a programming language that is not susceptible to these issues.
- Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-525v-9gp9-w22h Forge: TLS client crash when the server sends no certificate | Medium | Same weakness, CWE-476 |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High | Same weakness, CWE-476 |
| GHSA-cp9v-662q-vvx9 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 | High | Same weakness, CWE-476 |
| GHSA-27h8-gf7j-v5hc Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images | High | Same weakness, CWE-476 |
| GHSA-3x6r-wxxg-53vv rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic | Medium | Same weakness, CWE-476 |
| GHSA-m932-crvm-gcp5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | Low | Same weakness, CWE-476 |
| GHSA-qh5g-q395-cx4j ImageMagick: Heap-use-after-free via XMP profile could result in a crash | Medium | Same weakness, CWE-476 |
| GO-2026-5810 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) | Low | Same weakness, CWE-476 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor