Falhas do tipo CWE-476

2.331 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-23831MEDIUMRekor COSE v0.0.1 Canonicalize crashes when passed empty MessageEPSS 0.4%CVE-2022-41889MEDIUMSegfault via invalid attributes in `pywrap_tfe_src.cc` in TensorflowEPSS 0.4%CVE-2026-92413MEDIUMArtifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereferenceEPSS 0.4%CVE-2025-59148HIGHSuricata's improper use of entropy keyword can lead to a NULL-ptr derefEPSS 0.4%CVE-2023-30755MEDIUMA vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUEPSS 0.4%CVE-2026-77217MEDIUMPLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS HandlersEPSS 0.4%CVE-2023-33056HIGHNULL Pointer dereference in WLAN FirmwareEPSS 0.4%CVE-2022-21546HIGHscsi: target: Fix WRITE_SAME No Data Buffer crashEPSS 0.4%CVE-2026-67184HIGHTinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP RequestEPSS 0.4%CVE-2021-42376—A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validEPSS 0.4%CVE-2023-5441MEDIUMNULL Pointer Dereference in vim/vimEPSS 0.4%CVE-2025-59777HIGHNULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the EPSS 0.4%CVE-2024-45156HIGHAnimate | NULL Pointer Dereference (CWE-476)EPSS 0.4%CVE-2025-43967LOWlibheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can referencEPSS 0.4%CVE-2022-39837MEDIUMAn issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a craftedEPSS 0.4%CVE-2025-69624HIGHNitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). WhEPSS 0.4%CVE-2025-55780HIGHA null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. SEPSS 0.4%CVE-2023-2731MEDIUMA NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attackerEPSS 0.4%CVE-2025-65564HIGHA denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives aEPSS 0.4%CVE-2024-9472HIGHPAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted TrafficEPSS 0.4%