Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-48139HIGHNULL pointer dereference vulnerability in NI grpc-device data moniker serviceEPSS 0.5%CVE-2026-26453HIGHccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() functioEPSS 0.5%CVE-2022-2874MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.5%CVE-2026-36912HIGHA NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers toEPSS 0.5%CVE-2026-26457HIGHccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when procesEPSS 0.5%CVE-2026-56017HIGHJavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slashEPSS 0.5%CVE-2026-52878HIGHKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainEPSS 0.5%CVE-2026-25798MEDIUMImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted imageEPSS 0.5%CVE-2025-7462MEDIUMArtifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereferenceEPSS 0.5%CVE-2020-3552HIGHCisco Aironet Access Points Ethernet Wired Clients Denial of Service VulnerabilityEPSS 0.5%CVE-2026-24883LOWIn GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leadinEPSS 0.5%CVE-2023-37456—The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <EPSS 0.5%CVE-2024-3184MEDIUMMultiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAEPSS 0.5%CVE-2025-59777HIGHNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the EPSS 0.5%CVE-2021-33798MEDIUMA null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and poteEPSS 0.5%CVE-2023-38676MEDIUMSegfault in paddle.dotEPSS 0.5%CVE-2026-55204HIGHHAProxy - NULL Pointer Dereference in hpack_dht_insert FunctionEPSS 0.5%CVE-2023-52303MEDIUMSegfault in paddle.put_along_axisEPSS 0.5%CVE-2018-5449—A NULL Pointer Dereference issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application does EPSS 0.5%CVE-2023-52312MEDIUMNull pointer dereference in paddle.cropEPSS 0.5%