Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-48139HIGHNULL pointer dereference vulnerability in NI grpc-device data moniker serviceEPSS 0.5%CVE-2026-26453HIGHccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() functioEPSS 0.5%CVE-2022-2874MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.5%CVE-2026-36912HIGHA NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers toEPSS 0.5%CVE-2026-26457HIGHccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when procesEPSS 0.5%CVE-2026-56017HIGHJavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slashEPSS 0.5%CVE-2026-52878HIGHKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainEPSS 0.5%CVE-2026-25798MEDIUMImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted imageEPSS 0.5%CVE-2025-7462MEDIUMArtifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereferenceEPSS 0.5%CVE-2020-3552HIGHCisco Aironet Access Points Ethernet Wired Clients Denial of Service VulnerabilityEPSS 0.5%CVE-2026-24883LOWIn GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leadinEPSS 0.5%CVE-2023-37456—The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <EPSS 0.5%CVE-2024-3184MEDIUMMultiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAEPSS 0.5%CVE-2025-59777HIGHNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the EPSS 0.5%CVE-2021-33798MEDIUMA null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and poteEPSS 0.5%CVE-2023-38676MEDIUMSegfault in paddle.dotEPSS 0.5%CVE-2026-55204HIGHHAProxy - NULL Pointer Dereference in hpack_dht_insert FunctionEPSS 0.5%CVE-2023-52303MEDIUMSegfault in paddle.put_along_axisEPSS 0.5%CVE-2018-5449—A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does EPSS 0.5%CVE-2023-52312MEDIUMNull pointer dereference in paddle.cropEPSS 0.5%