Falhas do tipo CWE-476

2.331 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2022-47021HIGHA null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows atEPSS 0.4%CVE-2025-32787LOWSoftEtherVPN Affected by NULL dereference in DeleteIPv6DefaultRouterInRAEPSS 0.4%CVE-2026-25165HIGHPerformance Counters for Windows Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-90792MEDIUMGPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereferenceEPSS 0.4%CVE-2024-43167LOWUnbound: null pointer dereference in unboundEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-25795MEDIUMImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)EPSS 0.4%CVE-2026-10678HIGHNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerEPSS 0.4%CVE-2025-2957HIGHTRENDnet TEW-411BRP+ HTTP Request httpd sub_401DB0 null pointer dereferenceEPSS 0.4%CVE-2026-7701MEDIUMTelegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceEPSS 0.4%CVE-2025-2956HIGHTRENDnet TI-G102i HTTP Request lighttpd plugins_call_handle_uri_raw null pointer dereferenceEPSS 0.4%CVE-2021-47476MEDIUMcomedi: ni_usb6501: fix NULL-deref in command pathsEPSS 0.4%CVE-2025-23100HIGHAn issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. The absence of a NULL check leads to a Denial of SeEPSS 0.4%CVE-2021-4095—A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unpriviEPSS 0.4%CVE-2026-17165HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.4%CVE-2021-4145—A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced EPSS 0.4%CVE-2024-25073MEDIUMAn issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, ExEPSS 0.4%CVE-2025-57155HIGHNULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after EPSS 0.4%CVE-2026-24641LOWA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, ForEPSS 0.4%CVE-2025-4476MEDIUMLibsoup: null pointer dereference in libsoup may lead to denial of serviceEPSS 0.4%