Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-41647MEDIUMIncus: Nil-Pointer Dereference via S3 Bucket ImportEPSS 0.4%CVE-2026-109107MEDIUMWavlink WL-WN592AX6 upload.cgi main null pointer dereferenceEPSS 0.4%CVE-2023-25660HIGHTensorFlow vulnerable to seg fault in `tf.raw_ops.Print`EPSS 0.4%CVE-2024-43167LOWUnbound: null pointer dereference in unboundEPSS 0.4%CVE-2023-25674HIGHTensorFlow has Null Pointer Error in RandomShuffle with XLA enableEPSS 0.4%CVE-2023-24910HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2018-14646MEDIUMThe Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the EPSS 0.4%CVE-2025-29838HIGHWindows ExecutionContext Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-7700MEDIUMFfmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)EPSS 0.4%CVE-2025-20755MEDIUMIn Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-19888HIGHNULL pointer dereference in SCRAM client-final-message parsing in PgBouncerEPSS 0.4%CVE-2026-69978MEDIUMMicrosoft Windows VMSwitch Denial of Service VulnerabilityEPSS 0.4%CVE-2026-91954HIGHFreeRDP before 3.31.0 NULL Pointer Dereference via NSCodecEPSS 0.4%CVE-2026-44322HIGHfree5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferenceEPSS 0.4%CVE-2026-10678HIGHNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerEPSS 0.4%CVE-2026-7701MEDIUMTelegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceEPSS 0.4%CVE-2021-47476MEDIUMcomedi: ni_usb6501: fix NULL-deref in command pathsEPSS 0.4%CVE-2021-4095—A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unpriviEPSS 0.4%CVE-2025-24251MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS SonoEPSS 0.4%CVE-2021-4145—A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced EPSS 0.4%