Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2024-30295HIGHWhen Animate parses FLA files, there is a UAF vulnerability caused by referencing uninitialized memory at Animate.exe+0x1149dcfEPSS 0.4%CVE-2026-31931HIGHSuricata tls: null dereference in tls.alpn rule keywordEPSS 0.4%CVE-2025-20647MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.4%CVE-2025-50950HIGHAudiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.EPSS 0.4%CVE-2022-29206MEDIUMMissing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlowEPSS 0.4%CVE-2026-114408HIGHNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullEPSS 0.4%CVE-2025-53408LOWFile Station 5EPSS 0.4%CVE-2025-52865LOWFile Station 5EPSS 0.4%CVE-2025-47207MEDIUMFile Station 5EPSS 0.4%CVE-2022-49928HIGHSUNRPC: Fix null-ptr-deref when xps sysfs alloc failedEPSS 0.4%CVE-2026-76787MEDIUMNULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumEPSS 0.4%CVE-2026-86128HIGHFireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of ServiceEPSS 0.4%CVE-2025-57613HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor functEPSS 0.4%CVE-2025-57615HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor functionEPSS 0.4%CVE-2024-24446MEDIUMAn uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a craEPSS 0.4%CVE-2025-57612HIGHAn issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attEPSS 0.4%CVE-2023-25672HIGHTensorFlow has Null Pointer Error in LookupTableImportV2EPSS 0.4%CVE-2026-25501MEDIUMfree5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.DLDR is set but DownlinkDataReport IE is missingEPSS 0.4%CVE-2022-41843MEDIUMAn issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-3892EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%