Fallos del tipo CWE-476

2331 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2022-47021HIGHA null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows atEPSS 0.4%CVE-2025-32787LOWSoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRAEPSS 0.4%CVE-2026-25165HIGHPerformance Counters for Windows Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-90792MEDIUMGPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereferenceEPSS 0.4%CVE-2024-43167LOWUnbound: null pointer dereference in unboundEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-25795MEDIUMImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)EPSS 0.4%CVE-2026-10678HIGHNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerEPSS 0.4%CVE-2025-2957HIGHTRENDnet TEW-411BRP+ HTTP Request httpd sub_401DB0 null pointer dereferenceEPSS 0.4%CVE-2026-7701MEDIUMTelegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceEPSS 0.4%CVE-2025-2956HIGHTRENDnet TI-G102i HTTP Request lighttpd plugins_call_handle_uri_raw null pointer dereferenceEPSS 0.4%CVE-2021-47476MEDIUMcomedi: ni_usb6501: fix NULL-deref in command pathsEPSS 0.4%CVE-2025-23100HIGHAn issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. The absence of a NULL check leads to a Denial of SeEPSS 0.4%CVE-2021-4095—A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unpriviEPSS 0.4%CVE-2026-17165HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.4%CVE-2021-4145—A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced EPSS 0.4%CVE-2024-25073MEDIUMAn issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, ExEPSS 0.4%CVE-2025-57155HIGHNULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after EPSS 0.4%CVE-2026-24641LOWA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForEPSS 0.4%CVE-2025-4476MEDIUMLibsoup: null pointer dereference in libsoup may lead to denial of serviceEPSS 0.4%