Weakness (CWE)
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it (5 mitigations)
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Requirements
Select a programming language that is not susceptible to these issues.
-
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
Source: MITRE CWE-476
232 results · Clear filters · Feed
-
Low 2.7
Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter
Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every su…
-
Low 2.1
Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt…
-
Low 3.7
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the…
-
Low 2.3
NULL Pointer Dereference in qsyncsrv.cgi
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the f…
-
Low 2.3
NULL Pointer Dereference in qsyncsrv.cgi
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the f…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed mem…
-
Low 3.7
ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of se…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting…
-
Low 3.1
FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentatio…
-
Low 3.3
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation r…
-
Low 2.9
M17n-lib: null dereference in minput_open_im() after failed m17n_init()
A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an …
-
Low 3.3
Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A truste…
-
Low 3.1
ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM
ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory (resource) limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferen…
-
Low 3.3
GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference
A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The …
-
Low 3.3
GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs…
-
Low 3.3
GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference
A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been …
-
Low 3.3
GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference
A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the component Eh Frame Handler. Performing a manipulation results in null pointer dereference. The attack mu…
-
Low 3.3
GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally.…
-
Low 3.3
GPAC MP4Box vrml_tools.c null pointer dereference
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local …
-
Low 3.5
An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2…
-
Low 3.3
GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be pe…
-
Low 3.3
GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach t…
-
Low 2.5
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all …
-
Low 2.1
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnap…
-
Low 2.1
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot…
-
Low 3.3
BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access i…
-
Low 2.7
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
-
Low 3.9
Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
-
Low 2.6
nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service …
-
Low 3.1
open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference
A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceAr…
-
Low 3.7
ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crash…
-
Low 2.4
NanaZip: NULL pointer dereference in Extract() of all seven NanaZip custom archive handlers when extracting/testing the whole archive
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract when the archive engin…
-
Low 3.3
GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference
A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The a…
-
Low 3.3
GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference
A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The…
-
Low 1.7
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a…
-
Low 1.2
QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have alrea…
-
Low 1.3
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the …
-
Low 3.3
ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference
A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The expl…
-
Low 3.3
Assimp glTF2Asset.h LazyDict null pointer dereference
A vulnerability has been found in Assimp up to 6.0.4. Affected by this issue is the function glTF2::LazyDict in the library glTF2Asset.h. Such manipulation of the argument operator[] leads to null pointer dereference. The attack must be carried out locally. T…
-
Low 3.3
Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference
A flaw has been found in Assimp up to 6.0.4. Affected by this vulnerability is the function Assimp::glTFImporter::ImportMeshes of the file glTFImporter.cpp of the component glTFImporter. This manipulation causes null pointer dereference. The attack is restric…