Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2024-30295HIGHWhen Animate parses FLA files, there is a UAF vulnerability caused by referencing uninitialized memory at Animate.exe+0x1149dcfEPSS 0.4%CVE-2026-31931HIGHSuricata tls: null dereference in tls.alpn rule keywordEPSS 0.4%CVE-2025-20647MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.4%CVE-2025-50950HIGHAudiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.EPSS 0.4%CVE-2022-29206MEDIUMMissing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlowEPSS 0.4%CVE-2026-114408HIGHNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullEPSS 0.4%CVE-2025-53408LOWFile Station 5EPSS 0.4%CVE-2025-52865LOWFile Station 5EPSS 0.4%CVE-2025-47207MEDIUMFile Station 5EPSS 0.4%CVE-2022-49928HIGHSUNRPC: Fix null-ptr-deref when xps sysfs alloc failedEPSS 0.4%CVE-2026-76787MEDIUMNULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumEPSS 0.4%CVE-2026-86128HIGHFireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of ServiceEPSS 0.4%CVE-2025-57613HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor functEPSS 0.4%CVE-2025-57615HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor functionEPSS 0.4%CVE-2024-24446MEDIUMAn uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a craEPSS 0.4%CVE-2025-57612HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attEPSS 0.4%CVE-2023-25672HIGHTensorFlow has Null Pointer Error in LookupTableImportV2EPSS 0.4%CVE-2026-25501MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missingEPSS 0.4%CVE-2022-41843MEDIUMAn issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-3892EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%