Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-107778HIGHMIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()EPSS 0.4%CVE-2023-2908MEDIUMLibtiff: null pointer dereference in tif_dir.cEPSS 0.4%CVE-2026-69384HIGHVirtual Hard Disk (VHD) Miniport Driver Denial of Service VulnerabilityEPSS 0.4%CVE-2023-37028MEDIUMA Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95EPSS 0.4%CVE-2026-45747HIGHSuricata lua/tls: null dereference in TlsGetCertInfoEPSS 0.4%CVE-2025-63647HIGHA NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial EPSS 0.4%CVE-2024-57719MEDIUMlunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.EPSS 0.4%CVE-2026-33262MEDIUMInsufficient validation of cookie replyEPSS 0.4%CVE-2026-42285HIGHGoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)EPSS 0.4%CVE-2025-32398HIGHA NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libraryEPSS 0.4%CVE-2024-24194HIGHrobdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.EPSS 0.4%CVE-2026-88373HIGHlibde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zeEPSS 0.4%CVE-2022-25710HIGHDenial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustriEPSS 0.4%CVE-2021-39251MEDIUMA crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.EPSS 0.4%CVE-2025-25473MEDIUMFFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.EPSS 0.4%CVE-2022-25741HIGHDenial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon CompuEPSS 0.4%CVE-2026-32696LOWNanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerableEPSS 0.4%CVE-2023-33461MEDIUMiniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getEPSS 0.4%CVE-2025-30671MEDIUMZoom Workplace Apps for Windows - Null PointerEPSS 0.4%CVE-2024-35618HIGHPingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.EPSS 0.4%