Weakness (CWE)
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it (5 mitigations)
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Requirements
Select a programming language that is not susceptible to these issues.
-
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
Source: MITRE CWE-476
1,545 results · Clear filters · Feed
-
Medium 6.5
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-…
-
Medium 5.5
ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA sec…
-
Medium 5.5
xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose work…
-
Medium 5.5
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation…
-
Medium 5.5
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation…
-
Medium 5.5
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation…
-
Medium 5.5
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation…
-
Medium 5.5
Photoshop Desktop | NULL Pointer Dereference (CWE-476)
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of t…
-
Medium 5.5
Photoshop Desktop | NULL Pointer Dereference (CWE-476)
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of t…
-
Medium 5.5
Substance3D - Stager | NULL Pointer Dereference (CWE-476)
Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation o…
-
Medium 5.5
Dimension | NULL Pointer Dereference (CWE-476)
Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issu…
-
Medium 6.5
Windows Hyper-V Denial of Service Vulnerability
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
-
Medium 6.5
Windows Message Queuing Queue Manager Denial of Service Vulnerability
Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.
-
Medium 6.5
Windows Hyper-V Denial of Service Vulnerability
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
-
Medium 6.5
Windows Active Directory Domain Services Denial of Service Vulnerability
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
Medium 5.5
Windows Audio Service Information Disclosure Vulnerability
Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
-
Medium 5.6
Microsoft Windows VMSwitch Denial of Service Vulnerability
Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.
-
Medium 5.5
Adobe Framemaker | NULL Pointer Dereference (CWE-476)
Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of th…
-
Medium 6.5
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated user…
-
Medium 6.5
FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious…
-
Medium 6.5
FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized be…
-
Medium 5.3
FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and cras…
-
Medium 6.5
Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remot…
-
Medium 5.3
FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCou…
-
Medium 5.5
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream pointers. T…
-
Medium 5.5
Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can …
-
Medium 5.4
NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was su…
-
Medium 5.5
Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger…
-
Medium 4.0
Cups: null pointer dereference via embedded job ticket comments allows remote denial of service
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared pr…
-
Medium 5.1
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-c…
-
Medium 6.8
SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at …
-
Medium 6.5
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more ti…
-
Medium 4.9
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S…
-
Medium 5.9
NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver…
-
Medium 5.9
IBM DataPower Gateway NULL Pointer Dereference
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable proc…
-
Medium 6.5
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure.…
-
Medium 6.2
M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8
A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Servi…
-
Medium 6.5
Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low…
-
Medium 6.2
Sssd: sssd: denial of service via crafted passkey kerberos authentication request
A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos h…
-
Medium 5.9
Sssd: sssd: denial of service via missing sid extension in certificate mapping
A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to ve…