CVE-2026-42801

HighCVSS 7.4/10Last modified Sep 23, 2026

Description

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation.

This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-428047.6A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commitCVE-2026-428058.4A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser functCVE-2026-428064.3An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically withinCVE-2026-428078.0A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allCVE-2026-428086.8An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.  The host streaming API function {{coines_read_stream_seCVE-2026-428099.9Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location hasCVE-2026-42815.3The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.CVE-2026-428109.9Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated CVE-2026-428119.9In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespacCVE-2026-428129.9In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table versCVE-2026-42827.4A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulneraCVE-2026-4282210.0Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-42801: High severity, CVSS 7.4 | Vulnix