CVE-2026-4743
NULL Pointer Dereference in ncmdump src/utils Causes Crash
Publication date: 2026-03-24
Last updated on: 2026-05-05
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| taurusxin | ncmdump | to 1.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4743 is a NULL Pointer Dereference vulnerability found in the taurusxin ncmdump project, specifically in the src/utils modules related to the cJSON.cpp file. The issue occurs in the function cJSON_InsertItemInArray(), where a null pointer could be dereferenced, potentially causing the program to crash or behave unexpectedly.
This vulnerability was originally reported upstream in the DaveGamble/cJSON library and has been backported and fixed in ncmdump by adding a NULL pointer check to prevent such dereferences.
How can this vulnerability impact me? :
The NULL Pointer Dereference vulnerability can cause the ncmdump program to crash or terminate unexpectedly when processing certain inputs. This can lead to denial of service conditions where the application becomes unavailable or unstable.
While it does not directly allow code execution or data leakage, the instability caused by this vulnerability can disrupt normal operations and potentially be exploited to degrade service reliability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update ncmdump to version 1.4.0 or later, which includes the security fix.
The fix involves applying a patch that adds a NULL pointer check in the function cJSON_InsertItemInArray() located in src/utils/cJSON.cpp to prevent null pointer dereference.
If you maintain your own build, ensure to backport or apply the patch from the upstream DaveGamble/cJSON repository or the ncmdump pull request #52.