Falhas do tipo CWE-476

2.332 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2023-24755MEDIUMlibde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc. ThEPSS 0.3%CVE-2023-24758MEDIUMlibde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc. EPSS 0.3%CVE-2025-27185MEDIUMAfter Effects | NULL Pointer Dereference (CWE-476)EPSS 0.3%CVE-2023-3106MEDIUMKernel: netlink socket crash (null pointer deref) in netlink_dump functionEPSS 0.3%CVE-2023-24757MEDIUMlibde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc.EPSS 0.3%CVE-2023-24756MEDIUMlibde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc. ThEPSS 0.3%CVE-2022-49492MEDIUMnvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tagsEPSS 0.3%CVE-2022-49307MEDIUMtty: synclink_gt: Fix null-pointer-dereference in slgt_clean()EPSS 0.3%CVE-2022-49450MEDIUMrxrpc: Fix listen() setting the bar too high for the prealloc ringsEPSS 0.3%CVE-2023-46048MEDIUMTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized aEPSS 0.3%CVE-2025-63744MEDIUMA NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. ProcessiEPSS 0.3%CVE-2024-55069MEDIUMffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.EPSS 0.3%CVE-2026-2507HIGHBIG-IP TMM VulnerabilityEPSS 0.3%CVE-2025-24179MEDIUMA null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macEPSS 0.3%CVE-2023-53382CRITICALnet/smc: Reset connection when trying to use SMCRv2 fails.EPSS 0.3%CVE-2023-3355MEDIUMNull pointer dereference in submit_lookup_cmds() in drivers/gpu/drm/msm/msm_gem_submit.cEPSS 0.3%CVE-2026-42800HIGHDeference after null check in ims_client sipEPSS 0.3%CVE-2024-28577MEDIUMNull Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) EPSS 0.3%CVE-2025-62817HIGHAn issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of sessiEPSS 0.3%CVE-2026-20457MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.3%