Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-1975MEDIUMFree5GC pfcp_reports.go identityTriggerType null pointer dereferenceEPSS 0.6%CVE-2025-70954HIGHA Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is locEPSS 0.6%CVE-2026-78222HIGHNGINX ngx_http_js_module vulnerabilityEPSS 0.6%CVE-2025-58472LOWQsync CentralEPSS 0.6%CVE-2021-3739—A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the buEPSS 0.6%CVE-2024-42058HIGHA null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions fEPSS 0.6%CVE-2025-21844HIGHsmb: client: Add check for next_buffer in receive_encrypted_standard()EPSS 0.6%CVE-2024-41883MEDIUMNull Pointer DereferenceEPSS 0.6%CVE-2021-4217—A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereferencEPSS 0.6%CVE-2022-31076MEDIUMMalicious Message can crash CloudCore in KubeEdgeEPSS 0.6%CVE-2026-97394HIGHkin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsEPSS 0.6%CVE-2025-3122LOWWebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereferenceEPSS 0.6%CVE-2024-8454MEDIUMPLANET Technology switch devices - Swctrl service DoS attackEPSS 0.6%CVE-2025-53011LOWMaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutputEPSS 0.6%CVE-2020-18378MEDIUMA NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38.26. A crafted wasm iEPSS 0.6%CVE-2024-22099MEDIUMNULL pointer deference in rfcomm_check_security in Linux kernelEPSS 0.6%CVE-2026-76905HIGHkin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoSEPSS 0.6%CVE-2026-38976HIGHmrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard forEPSS 0.6%CVE-2026-18064HIGHNASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer DereferenceEPSS 0.6%CVE-2026-15352HIGHNASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer DereferenceEPSS 0.6%