Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-9639MEDIUMAuthenticated Denial of Service via Malicious Backup Tarball in LXDEPSS 0.5%CVE-2025-68274HIGHSIPGO library has response DoS vulnerability via nil pointer dereferenceEPSS 0.5%CVE-2026-82588MEDIUMOpen5GS Transfer Endpoint namf-handler.c null pointer dereferenceEPSS 0.5%CVE-2025-47808MEDIUMIn GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle fileEPSS 0.5%CVE-2021-4198MEDIUMmessaging_ipc.dll NULL Pointer Dereference in multiple Bitdefender products (VA-10016)EPSS 0.5%CVE-2022-29029—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.5%CVE-2022-29031—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.5%CVE-2021-3322MEDIUMUnexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in ZephyrEPSS 0.5%CVE-2024-48615HIGHNull Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchivEPSS 0.5%CVE-2025-4478MEDIUMGnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of serviceEPSS 0.5%CVE-2024-56688HIGHsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transportEPSS 0.5%CVE-2023-52302MEDIUMSegfault in paddle.nextafterEPSS 0.5%CVE-2025-32909MEDIUMLibsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.cEPSS 0.5%CVE-2026-68136CRITICALnet: gro: fix double aggregation of flush-marked skbsEPSS 0.5%CVE-2026-62299MEDIUMCoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT recordEPSS 0.5%CVE-2023-33056HIGHNULL Pointer dereference in WLAN FirmwareEPSS 0.5%CVE-2025-40779HIGHKea crash upon interaction between specific client options and subnet selectionEPSS 0.5%CVE-2024-21602HIGHJunos OS Evolved: ACX7024, ACX7100-32C and ACX7100-48L: Traffic stops when a specific IPv4 UDP packet is received by the REEPSS 0.5%CVE-2026-92051CRITICALSpoofing issue due to invalid pointer in the Graphics componentEPSS 0.5%CVE-2026-85150HIGHGstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate headerEPSS 0.5%