Weaknesses of type CWE-822

248 results

Desreferência de ponteiro não validado

O código desreferencia um ponteiro sem verificar se ele é válido, nulo ou aponta para memória acessível. Isso ocorre quando dados externos (entrada do usuário, rede, arquivo) são usados diretamente como endereço de memória, permitindo leitura ou escrita em regiões arbitrárias e causando crash, vazamento de dados ou execução de código.

Example

Uma aplicação C recebe um endereço de memória em JSON enviado pelo cliente e o usa diretamente: `int *ptr = (int*)json_value; printf("%d", *ptr);`. Um atacante envia um endereço inválido ou privilégio elevado, causando acesso à memória inacessível ou leitura de dados sensíveis.

How to mitigate

Nunca confie em ponteiros vindos de entrada externa. Use referências indiretas seguras (índices de array, handles opacos, offsets validados) em vez de ponteiros brutos. Sempre valide endereços antes de desreferenciar e implemente verificações de limites e proteções como ASLR e DEP no sistema operacional.

CVE-2024-40872HIGHElevation of privilege in Absolute Secure Access clients and serversEPSS 0.2%CVE-2025-20018MEDIUMUntrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileEPSS 0.2%CVE-2021-26410LOWImproper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memoEPSS 0.2%CVE-2024-25078HIGHA memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IBEPSS 0.1%CVE-2025-59959MEDIUMJunos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crashEPSS 0.1%CVE-2024-12576MEDIUMGPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned addressEPSS 0.1%CVE-2025-20090MEDIUMUntrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to poteEPSS 0.1%CVE-2025-27710MEDIUMUntrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an infEPSS 0.1%CVE-2026-7406HIGHBMP File Parsing Untrusted Pointer Dereference in certain Autodesk productsEPSS 0.1%CVE-2024-36352HIGHImproper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aEPSS 0.1%CVE-2025-52516MEDIUMAn issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalEPSS 0.1%CVE-2026-18840HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-94403CRITICALColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereferenceEPSS 0.1%CVE-2026-19442HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-45198HIGHGPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrustedEPSS 0.1%CVE-2026-12364HIGHMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceEPSS 0.1%CVE-2025-32446MEDIUMUntrusted pointer dereference for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allowEPSS 0.1%CVE-2026-19023MEDIUMHDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String DatasetsEPSS 0.1%CVE-2024-53033HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%CVE-2024-53034HIGHUntrusted Pointer Dereference in DSP_ServicesEPSS 0.1%