Fallos del tipo CWE-476

2331 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2025-70954HIGHA Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is locEPSS 0.6%CVE-2024-56318HIGHIn raw\TCP.cpp in Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before 27ca6ec, there is a NULL pointer dereference in TCPBasEPSS 0.6%CVE-2026-67870CRITICALIn open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targetEPSS 0.6%CVE-2024-3858HIGHIt was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox < 125.EPSS 0.6%CVE-2021-4198MEDIUMmessaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)EPSS 0.6%CVE-2026-11788MEDIUM389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parserEPSS 0.6%CVE-2023-52883HIGHdrm/amdgpu: Fix possible null pointer dereferenceEPSS 0.6%CVE-2024-39948HIGHA vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cEPSS 0.6%CVE-2026-42767MEDIUMNULL Pointer Dereference in CRMF EncryptedValue DecryptionEPSS 0.6%CVE-2024-31041HIGHNull Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of serEPSS 0.6%CVE-2023-6603HIGHFfmpeg: null pointer dereference in ffmpeg hls parsingEPSS 0.6%CVE-2022-2549MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 0.6%CVE-2024-54952HIGHMikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issEPSS 0.6%CVE-2025-54989MEDIUMFirebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service VulnerabilityEPSS 0.6%CVE-2025-30667MEDIUMZoom Workplace Apps - NULL Pointer DereferenceEPSS 0.5%CVE-2025-30666MEDIUMZoom Workplace Apps for Windows - NULL Pointer DereferenceEPSS 0.5%CVE-2025-30665MEDIUMZoom Workplace Apps for Windows - NULL Pointer DereferenceEPSS 0.5%CVE-2025-41691HIGHCODESYS Control DoS via Unauthenticated NULL Pointer DereferenceEPSS 0.5%CVE-2026-9639MEDIUMAuthenticated Denial of Service via Malicious Backup Tarball in LXDEPSS 0.5%CVE-2026-1973MEDIUMFree5GC SMF establishPfcpSession null pointer dereferenceEPSS 0.5%