CVE-2026-8360: Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS

Synopsis

A NULL pointer dereference vulnerability affects Gladinet Triofox, a file-sharing and remote access server product. The flaw is reachable over the network without any authentication or user interaction, triggered when function calls inside WOSCommonUtil.dll return a NULL pointer that is subsequently dereferenced without a validity check. Successful exploitation crashes the Triofox service, causing a denial of service. A patched-image rebuild at version 17.3.10565.57509 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network, so an attacker must be able to reach the Triofox service on its listening port.

• AuthenticationNot required

  No credentials or session token are needed; the NULL dereference can be triggered by an unauthenticated request when no user is logged into the Triofox Server Agent Management Console.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted request directly to the service without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory layout knowledge.

Blast Radius

• Crashes the Triofox server process, taking the file-sharing and remote-access service offline for all connected users.
• Repeated requests can keep the service unavailable indefinitely, effectively acting as a sustained denial-of-service attack.
• No confidential data is read and no stored data is modified; impact is limited to availability of the Triofox service.