Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-107778HIGHMIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()EPSS 0.4%CVE-2023-2908MEDIUMLibtiff: null pointer dereference in tif_dir.cEPSS 0.4%CVE-2026-69384HIGHVirtual Hard Disk (VHD) Miniport Driver Denial of Service VulnerabilityEPSS 0.4%CVE-2023-37028MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2026-45747HIGHSuricata lua/tls: null dereference in TlsGetCertInfoEPSS 0.4%CVE-2025-63647HIGHA NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial EPSS 0.4%CVE-2024-57719MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.EPSS 0.4%CVE-2026-33262MEDIUMInsufficient validation of cookie replyEPSS 0.4%CVE-2026-42285HIGHGoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)EPSS 0.4%CVE-2025-32398HIGHA NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libraryEPSS 0.4%CVE-2024-24194HIGHrobdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.EPSS 0.4%CVE-2026-88373HIGHlibde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zeEPSS 0.4%CVE-2022-25710HIGHDenial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustriEPSS 0.4%CVE-2021-39251MEDIUMA crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.EPSS 0.4%CVE-2025-25473MEDIUMFFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.EPSS 0.4%CVE-2022-25741HIGHDenial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon CompuEPSS 0.4%CVE-2026-32696LOWNanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerableEPSS 0.4%CVE-2023-33461MEDIUMiniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getEPSS 0.4%CVE-2025-30671MEDIUMZoom Workplace Apps for Windows - Null PointerEPSS 0.4%CVE-2024-35618HIGHPingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.EPSS 0.4%