Falhas do tipo CWE-476

2.572 resultados

Desreferenciação de ponteiro nulo autenticado

O software permite que um usuário autenticado force a desreferenciação de um ponteiro ou referência nula, tipicamente ao passar valores inesperados ou inválidos a uma função. O aplicativo não valida adequadamente a entrada antes de usá-la, causando falha (crash) ou comportamento indefinido que pode levar a negação de serviço.

Exemplo

Um painel administrativo aceita um ID de usuário para deletar, mas não verifica se esse ID existe no banco antes de acessar seus atributos. Um admin autenticado passa ID=0 ou um valor que não corresponde a nenhum registro, e o código tenta acessar propriedades de um objeto nulo, derrubando a aplicação.

Como mitigar

Sempre valide e verifique que referências/ponteiros são válidos antes de desreferenciar: teste se o objeto existe, se o ID é válido e se está dentro do escopo esperado. Use assertions em desenvolvimento e tratamento de exceções robusto em produção para falhas inesperadas.

CVE-2026-58101HIGHCrypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereferenceEPSS 0.3%CVE-2022-35087MEDIUMSWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.EPSS 0.3%CVE-2025-69649MEDIUMGNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header EPSS 0.3%CVE-2026-107613MEDIUMNULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initializationEPSS 0.3%CVE-2024-55069MEDIUMffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.EPSS 0.3%CVE-2023-27114MEDIUMradare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.EPSS 0.3%CVE-2026-9743HIGHAggregation sub-pipeline null dereference may allow DoS via crafted getMoreEPSS 0.3%CVE-2026-16846MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.3%CVE-2026-102623MEDIUMKubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volumeEPSS 0.3%CVE-2024-25260MEDIUMelfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.EPSS 0.3%CVE-2023-4681MEDIUMNULL Pointer Dereference in gpac/gpacEPSS 0.3%CVE-2024-45235HIGHAn issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync oEPSS 0.3%CVE-2024-45238HIGHAn issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync oEPSS 0.3%CVE-2026-109679MEDIUMFreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM ResponseEPSS 0.3%CVE-2024-55511HIGHA null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentiallyEPSS 0.3%CVE-2025-64085MEDIUMA NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a DeEPSS 0.3%CVE-2025-64086MEDIUMA NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to causEPSS 0.3%CVE-2026-96953HIGHWindows Universal Disk Format File System Driver (UDFS) Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-65502MEDIUMNull pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initiEPSS 0.3%CVE-2020-27830—A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checkEPSS 0.3%