Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2025-11845MEDIUMA null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware versions through 5.50(EPSS 0.9%CVE-2021-40027—The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confEPSS 0.9%CVE-2022-36659MEDIUMxhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulnerability allows attackEPSS 0.9%CVE-2022-36661MEDIUMxhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnerability allows attackeEPSS 0.9%CVE-2024-21664MEDIUMParsing JSON serialized payload without protected field can lead to segfaultEPSS 0.9%CVE-2022-3341MEDIUMA null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs bEPSS 0.9%CVE-2025-62848HIGHQTS, QuTS heroEPSS 0.9%CVE-2022-2980MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.9%CVE-2024-20436HIGHA vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticEPSS 0.9%CVE-2023-23087CRITICALAn issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.EPSS 0.9%CVE-2022-44018HIGHIn Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-oEPSS 0.9%CVE-2023-24822HIGHRIOT-OS vulnerable to Null Pointer dereference during IPHC encodingEPSS 0.9%CVE-2025-32913HIGHLibsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition headerEPSS 0.9%CVE-2022-27497HIGHNull pointer dereference in firmware for Intel(R) AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allEPSS 0.9%CVE-2026-18453HIGH389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchEPSS 0.8%CVE-2021-3320MEDIUMType Confusion in 802154 ACK Frames HandlingEPSS 0.8%CVE-2024-26924HIGHnetfilter: nft_set_pipapo: do not free live elementEPSS 0.8%CVE-2023-29996HIGHIn NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.EPSS 0.8%CVE-2025-32818HIGHA Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash tEPSS 0.8%CVE-2021-33068MEDIUMNull pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial EPSS 0.8%