Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2022-31077MEDIUMMalicious response from KubeEdge can crash CSI Driver controller serverEPSS 0.8%CVE-2023-33306MEDIUMA null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allEPSS 0.8%CVE-2025-24177HIGHA null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macEPSS 0.8%CVE-2026-28389HIGHPossible NULL Dereference When Processing CMS KeyAgreeRecipientInfoEPSS 0.8%CVE-2026-28390HIGHPossible NULL Dereference When Processing CMS KeyTransportRecipientInfoEPSS 0.8%CVE-2018-6343HIGHProxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiEPSS 0.8%CVE-2024-26130HIGHcryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideEPSS 0.8%CVE-2024-23080CRITICALJoda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NEPSS 0.8%CVE-2024-26731MEDIUMbpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()EPSS 0.8%CVE-2022-40733MEDIUMAn access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of WindEPSS 0.8%CVE-2019-1010162—jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcEPSS 0.8%CVE-2022-0890MEDIUMNULL Pointer Dereference in mruby/mrubyEPSS 0.8%CVE-2020-27819—An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exEPSS 0.8%CVE-2022-1035LOWSegmentation Fault caused by MP4Box -lsr in gpac/gpacEPSS 0.8%CVE-2023-52696HIGHpowerpc/powernv: Add a null pointer check in opal_powercap_init()EPSS 0.8%CVE-2025-15468MEDIUMNULL dereference in SSL_CIPHER_find() function on unknown cipher IDEPSS 0.8%CVE-2026-77901HIGHMicrosoft Office Word Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-36620MEDIUMmoby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.EPSS 0.8%CVE-2024-43559MEDIUMWindows Mobile Broadband Driver Denial of Service VulnerabilityEPSS 0.8%CVE-2025-53477HIGHApache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layerEPSS 0.8%