CVE-2026-4743
Deferred Deferred - Pending Action
NULL Pointer Dereference in ncmdump src/utils Causes Crash

Publication date: 2026-03-24

Last updated on: 2026-05-05

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description
NULL Pointer Dereference vulnerability in taurusxin ncmdump (‎src/utils‎ modules). This vulnerability is associated with program files cJSON.Cpp‎. This issue affects ncmdump: before 1.4.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-24
Last Modified
2026-05-05
Generated
2026-06-16
AI Q&A
2026-03-24
EPSS Evaluated
2026-06-15
NVD
CVE-2026-4743
EUVD
EUVD-2026-14700
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
taurusxin ncmdump to 1.4.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-4743 is a NULL Pointer Dereference vulnerability found in the taurusxin ncmdump project, specifically in the src/utils modules related to the cJSON.cpp file. The issue occurs in the function cJSON_InsertItemInArray(), where a null pointer could be dereferenced, potentially causing the program to crash or behave unexpectedly.

This vulnerability was originally reported upstream in the DaveGamble/cJSON library and has been backported and fixed in ncmdump by adding a NULL pointer check to prevent such dereferences.

Impact Analysis

The NULL Pointer Dereference vulnerability can cause the ncmdump program to crash or terminate unexpectedly when processing certain inputs. This can lead to denial of service conditions where the application becomes unavailable or unstable.

While it does not directly allow code execution or data leakage, the instability caused by this vulnerability can disrupt normal operations and potentially be exploited to degrade service reliability.

Compliance Impact

I don't know

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Mitigation Strategies

To mitigate this vulnerability, you should update ncmdump to version 1.4.0 or later, which includes the security fix.

The fix involves applying a patch that adds a NULL pointer check in the function cJSON_InsertItemInArray() located in src/utils/cJSON.cpp to prevent null pointer dereference.

If you maintain your own build, ensure to backport or apply the patch from the upstream DaveGamble/cJSON repository or the ncmdump pull request #52.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart