Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2025-8033MEDIUMIncorrect JavaScript state machine for generatorsEPSS 0.4%CVE-2021-42376—A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validEPSS 0.4%CVE-2024-45156HIGHAnimate | NULL Pointer Dereference (CWE-476)EPSS 0.4%CVE-2025-49694HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-38928HIGHXPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.EPSS 0.4%CVE-2025-20790MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.4%CVE-2025-69624HIGHNitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). WhEPSS 0.4%CVE-2025-55780HIGHA null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. SEPSS 0.4%CVE-2023-2731MEDIUMA NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attackerEPSS 0.4%CVE-2025-49686HIGHWindows TCP/IP Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-25795MEDIUMImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)EPSS 0.4%CVE-2025-65564HIGHA denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives aEPSS 0.4%CVE-2024-9472HIGHPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted TrafficEPSS 0.4%CVE-2026-23831MEDIUMRekor COSE v0.0.1 Canonicalize crashes when passed empty MessageEPSS 0.4%CVE-2026-67288HIGHFreeRDP before 3.29.0 Denial of Service via smartcard cacheEPSS 0.4%CVE-2026-62966HIGHESPAsyncWebServer multipart parser has null-pointer writeEPSS 0.4%CVE-2023-1264MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.4%CVE-2026-117610HIGHlibexpat through 2.9.0 NULL Pointer Dereference via External Entity SubparserEPSS 0.4%CVE-2023-42754MEDIUMKernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()EPSS 0.4%CVE-2025-14309HIGHNULL Pointer Dereference vulnerability in ravynsoft ravynos.This issue affects ravynos: through 0.5.2.EPSS 0.4%