Fallos del tipo CWE-476

2331 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2021-39251MEDIUMA crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.EPSS 0.4%CVE-2025-25473MEDIUMFFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.EPSS 0.4%CVE-2025-64335HIGHSuricata is vulnerable to a null deref when used with base64_dataEPSS 0.4%CVE-2025-9166HIGHRockwell Automation ControlLogix® 5580 V35.013 Denial-Of-ServiceEPSS 0.4%CVE-2026-69384HIGHVirtual Hard Disk (VHD) Miniport Driver Denial of Service VulnerabilityEPSS 0.4%CVE-2026-78126MEDIUMstrongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.EPSS 0.4%CVE-2025-65565HIGHA denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP asEPSS 0.4%CVE-2025-41414HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.4%CVE-2022-25710HIGHDenial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustriEPSS 0.4%CVE-2024-35618HIGHPingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.EPSS 0.4%CVE-2022-25741HIGHDenial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon CompuEPSS 0.4%CVE-2026-47276MEDIUMNULL Pointer Dereference in REST API properties_parse via Malformed user_propertiesEPSS 0.4%CVE-2023-33461MEDIUMiniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getEPSS 0.4%CVE-2025-62785MEDIUMWazuh fillData NULL pointer dereference causes analysisd crashEPSS 0.4%CVE-2024-28584LOWNull Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) EPSS 0.4%CVE-2025-63647HIGHA NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial EPSS 0.4%CVE-2021-42373—A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is givenEPSS 0.4%CVE-2024-36832HIGHA NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web requeEPSS 0.4%CVE-2024-52833MEDIUMSubstance3D - Modeler | NULL Pointer Dereference (CWE-476)EPSS 0.4%CVE-2025-20045HIGHBIG-IP SIP MRF VulnerabilityEPSS 0.4%