Fallos del tipo CWE-476

2572 resultados

Desreferência de ponteiro nulo autenticada remota

A aplicação tenta acessar um objeto ou endereço de memória que não foi inicializado ou foi definido como nulo, sem verificar essa condição antes. Um atacante autenticado consegue provocar esse acesso inválido enviando dados malformados ou inesperados, causando crash ou comportamento indefinido.

Ejemplo

Um endpoint autenticado de API recebe um ID de usuário, faz uma busca no banco que retorna nulo (usuário não existe) e tenta acessar diretamente campos desse objeto nulo sem validação — resultando em erro 500 ou travamento da aplicação.

Cómo mitigar

Sempre verificar se um objeto é nulo antes de usá-lo; usar análise estática (linters, SAST) para detectar acessos potenciais a nulos; validar e tratar casos onde dados esperados podem estar ausentes, mesmo que o usuário esteja autenticado.

CVE-2025-60019LOWGlib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()EPSS 0.4%CVE-2020-9085MEDIUMThere is a NULL pointer dereference vulnerability in some Huawei products. An attacker may send specially crafted POST messages to the affecEPSS 0.4%CVE-2026-73199MEDIUMIpa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request valueEPSS 0.4%CVE-2026-109272MEDIUMImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript DecoderEPSS 0.4%CVE-2026-10593MEDIUMRemotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingEPSS 0.4%CVE-2026-114046HIGHFreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcardEPSS 0.4%CVE-2025-0287MEDIUMCVE-2025-0287EPSS 0.4%CVE-2025-20262MEDIUMCisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service VulnerabilityEPSS 0.4%CVE-2026-26828HIGHA NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to causEPSS 0.4%CVE-2026-26025MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2024-39356HIGHNULL pointer dereference in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unaEPSS 0.4%CVE-2026-26024MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE EPSS 0.4%CVE-2023-52344MEDIUMIn modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosuEPSS 0.4%CVE-2025-47111MEDIUMAcrobat Reader | NULL Pointer Dereference (CWE-476)EPSS 0.4%CVE-2026-44323MEDIUMfree5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)EPSS 0.4%CVE-2026-44317MEDIUMfree5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferenceEPSS 0.4%CVE-2026-112381HIGHApache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked responseEPSS 0.4%CVE-2023-1631MEDIUMJiangMin Antivirus IOCTL kvcore.sys 0x222010 null pointer dereferenceEPSS 0.3%CVE-2025-10256MEDIUMFfmpeg: null pointer dereference in firequalizer filter (libavfilter/af_firequalizer.c)EPSS 0.3%CVE-2026-57873HIGHGV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi)EPSS 0.3%