Fallos del tipo CWE-476

2332 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2025-50950HIGHAudiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.EPSS 0.4%CVE-2024-30295HIGHWhen Animate parses FLA files, there is a UAF vulnerability caused by referencing uninitialized memory at Animate.exe+0x1149dcfEPSS 0.4%CVE-2026-76868MEDIUMNetcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_portEPSS 0.4%CVE-2026-76865MEDIUMNetcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter HandlersEPSS 0.4%CVE-2026-24409HIGHiccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()EPSS 0.4%CVE-2026-24410HIGHiccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()EPSS 0.4%CVE-2025-0696MEDIUMA NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embeEPSS 0.4%CVE-2023-25672HIGHTensorFlow has Null Pointer Error in LookupTableImportV2EPSS 0.4%CVE-2025-57615HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor functionEPSS 0.4%CVE-2025-57612HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attEPSS 0.4%CVE-2025-57613HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor functEPSS 0.4%CVE-2026-21485HIGHiccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()EPSS 0.4%CVE-2026-75013HIGHTOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereferenceEPSS 0.4%CVE-2026-75012HIGHTOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereferenceEPSS 0.4%CVE-2026-21688HIGHiccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cppEPSS 0.4%CVE-2025-64169MEDIUMWazuh NULL pointer dereference in fim_alert line 666EPSS 0.4%CVE-2026-8723MEDIUMqs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnlyEPSS 0.4%CVE-2025-0223MEDIUMIObit Protected Folder IOCTL IURegistryFilter.sys 0x8001E010 null pointer dereferenceEPSS 0.4%CVE-2025-0222MEDIUMIObit Protected Folder IOCTL IUProcessFilter.sys 0x8001E004 null pointer dereferenceEPSS 0.4%CVE-2025-0221MEDIUMIOBit Protected Folder IOCTL pffilter.sys 0x22200c null pointer dereferenceEPSS 0.4%