CVE-2026-8360: Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no user is logged into the Triofox Server Agent Management Console). The returned NULL pointer is not checked before being dereferenced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Ensure at least one user remains logged into the Triofox Server Agent Management Console (so WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() does not return NULL), or otherwise maintain a session that prevents the DLL call from returning NULL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8360?
The severity of CVE-2026-8360 is rated high with a score of 7.5.
What is the risk associated with CVE-2026-8360?
CVE-2026-8360 carries a risk score of 31.
How does CVE-2026-8360 impact the Gladinet Triofox software?
CVE-2026-8360 can lead to a Denial of Service due to unchecked NULL pointer dereferences in function calls.
What versions of Gladinet Triofox are affected by CVE-2026-8360?
CVE-2026-8360 affects the Gladinet Triofox Server Agent when no user is logged into the management console.
How do I fix CVE-2026-8360?
To fix CVE-2026-8360, ensure that input parameters are validated and establish user sessions before invoking the affected functions.