Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-66303MEDIUMSkype for Business and Lync Denial of Service VulnerabilityEPSS 1.1%CVE-2026-59138MEDIUMMicrosoft Remote Registry Service Denial of Service VulnerabilityEPSS 1.1%CVE-2026-62762MEDIUMWindows Active Directory Domain Services Denial of Service VulnerabilityEPSS 1.1%CVE-2026-56168MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 1.1%CVE-2026-84017HIGHWindows Routing and Remote Access Service (RRAS) Denial of Service VulnerabilityEPSS 1.1%CVE-2023-3316MEDIUMA NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.EPSS 1.1%CVE-2025-6491MEDIUMNULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace PrefixEPSS 1.1%CVE-2024-50608HIGHAn issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and porEPSS 1.1%CVE-2024-50609HIGHAn issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one canEPSS 1.1%CVE-2022-24809MEDIUMnet-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereferenceEPSS 1.1%CVE-2021-33717—A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1). When parsing sEPSS 1.1%CVE-2020-1656HIGHJunos OS: When a DHCPv6 Relay-Agent is configured upon receipt of a specific DHCPv6 client message, Remote Code Execution may occur.EPSS 1.1%CVE-2022-23589MEDIUMNull pointer dereference in Grappler's `IsConstant` in TensorflowEPSS 1.1%CVE-2024-47542MEDIUMGHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereferenceEPSS 1.1%CVE-2023-46427CRITICALAn issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial EPSS 1.1%CVE-2021-23191—A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may resuEPSS 1.1%CVE-2021-26927—A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of servEPSS 1.1%CVE-2017-7511—poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.EPSS 1.1%CVE-2025-7797MEDIUMGPAC dash_client.c gf_dash_download_init_segment null pointer dereferenceEPSS 1.1%CVE-2024-47544MEDIUMGHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handlingEPSS 1.1%