CVE-2026-8359: Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBinLoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not present in the installation. As a result, a function pointer to WOSBinLoadHttpModule (which would have been in the export table in WOSHttpStatusModule.dll) is set to NULL, resulting in calling a function at address 0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or disable the registration that causes WOSBin to load WOSHttpStatusModule.dll for requests whose URL path starts with /status or /sysinfo so the application does not attempt to call the missing export.
WOSBin HTTP module loader (Gladinet Triofox) load WOSHttpStatusModule for /status and /sysinfo = disabled / remove module registration - Compensating control
Block or restrict incoming HTTP requests with URL paths beginning with /status and /sysinfo at the network edge (WAF, reverse proxy, or firewall) until the missing DLL is restored or the module loading is disabled.
- Operational
Restore or install the missing WOSHttpStatusModule.dll into the application's installation so the exported WOSBin_LoadHttpModule function is present and the NULL function pointer call is avoided.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8359?
CVE-2026-8359 has a severity score of 7.5, indicating a high level of risk.
How do I fix CVE-2026-8359?
To fix CVE-2026-8359, ensure that the WOSHttpStatusModule.dll file is present and correctly configured in your Gladinet Triofox installation.
What impact does CVE-2026-8359 have on my system?
CVE-2026-8359 can cause a denial of service (DoS) by dereferencing a null pointer when handling specific URL requests.
What systems are affected by CVE-2026-8359?
CVE-2026-8359 affects systems using Gladinet Triofox that attempt to access URLs starting with /status or /sysinfo.
Is CVE-2026-8359 exploitable remotely?
Yes, CVE-2026-8359 is exploitable remotely as it can be triggered by sending requests to the affected URLs.