Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2026-41647MEDIUMIncus: Nil-Pointer Dereference via S3 Bucket ImportEPSS 0.4%CVE-2026-109107MEDIUMWavlink WL-WN592AX6 upload.cgi main null pointer dereferenceEPSS 0.4%CVE-2023-25660HIGHTensorFlow vulnerable to seg fault in `tf.raw_ops.Print`EPSS 0.4%CVE-2024-43167LOWUnbound: null pointer dereference in unboundEPSS 0.4%CVE-2023-25674HIGHTensorFlow has Null Pointer Error in RandomShuffle with XLA enableEPSS 0.4%CVE-2023-24910HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2018-14646MEDIUMThe Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the EPSS 0.4%CVE-2025-29838HIGHWindows ExecutionContext Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-7700MEDIUMFfmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)EPSS 0.4%CVE-2025-20755MEDIUMIn Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-19888HIGHNULL pointer dereference in SCRAM client-final-message parsing in PgBouncerEPSS 0.4%CVE-2026-69978MEDIUMMicrosoft Windows VMSwitch Denial of Service VulnerabilityEPSS 0.4%CVE-2026-91954HIGHFreeRDP before 3.31.0 NULL Pointer Dereference via NSCodecEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-10678HIGHNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerEPSS 0.4%CVE-2026-7701MEDIUMTelegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceEPSS 0.4%CVE-2021-47476MEDIUMcomedi: ni_usb6501: fix NULL-deref in command pathsEPSS 0.4%CVE-2021-4095—A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unpriviEPSS 0.4%CVE-2025-24251MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS SonoEPSS 0.4%CVE-2021-4145—A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced EPSS 0.4%