CVE-2026-30656: Null Pointer Dereference

Q: What must an attacker provide to trigger the crash?

They must cause fio to parse a job file that specifies the fdp_pli option without an argument. No authentication or user interaction is indicated by the supplied CVSS vector.

Q: What is the practical impact of successful exploitation?

The affected fio process terminates with a segmentation fault, creating a denial-of-service condition. The provided data indicates availability impact only; it does not indicate confidentiality or integrity impact.

Q: Which deployments are most exposed?

Deployments that accept, generate, or run job files from untrusted sources are most exposed, because the malformed fdp_pli option is contained in a job file. The data identifies fio v3.41 and Microsoft azl3 fio 3.37-3 as affected software entries.

Published Apr 16, 2026

Updated

A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdppli option. The callback function strfdpplicb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.

Affected Software

2 affected componentsFixes available

fio fio=3.41

Microsoft azl3 fio 3.37-3<3.37-4

3.37-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.37-4

Event History

Apr 16, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

May 3, 2026

Data Sourced

via Microsoft·08:02 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the crash?

They must cause fio to parse a job file that specifies the fdp_pli option without an argument. No authentication or user interaction is indicated by the supplied CVSS vector.

What is the practical impact of successful exploitation?

The affected fio process terminates with a segmentation fault, creating a denial-of-service condition. The provided data indicates availability impact only; it does not indicate confidentiality or integrity impact.

Which deployments are most exposed?

Deployments that accept, generate, or run job files from untrusted sources are most exposed, because the malformed fdp_pli option is contained in a job file. The data identifies fio v3.41 and Microsoft azl3 fio 3.37-3 as affected software entries.

CVE-2026-30656: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are most exposed?