Weakness (CWE)
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it (5 mitigations)
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Requirements
Select a programming language that is not susceptible to these issues.
-
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
Source: MITRE CWE-476
2,663 results · Feed
-
Medium 6.5
Windows Active Directory Domain Services Denial of Service Vulnerability
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
Medium 5.5
Windows Audio Service Information Disclosure Vulnerability
Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
-
Medium 5.6
Microsoft Windows VMSwitch Denial of Service Vulnerability
Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.
-
High 7.0
Windows Clipboard Server Elevation of Privilege Vulnerability
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Schannel Elevation of Privilege Vulnerability
Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Adobe Framemaker | NULL Pointer Dereference (CWE-476)
Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of th…
-
Medium 6.5
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated user…
-
High 7.1
CvFWD Null Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
-
High 7.5
yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing…
-
Medium 6.5
FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without a check. A malicious…
-
Medium 6.5
FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is not yet initialized be…
-
Medium 5.3
FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and cras…
-
Medium 6.5
Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remot…
-
High 7.5
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This all…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed mem…
-
Low 3.7
ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of se…
-
Low 2.5
ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting…
-
Medium 5.3
FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME
FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCou…
-
Low 3.1
FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentatio…
-
Medium 5.5
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream pointers. T…
-
Medium 5.5
Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can …
-
Medium 5.4
NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was su…
-
Medium 5.5
Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger…
-
Medium 4.0
Cups: null pointer dereference via embedded job ticket comments allows remote denial of service
A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared pr…
-
Low 3.3
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation r…
-
Medium 5.1
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-c…
-
Medium 6.8
SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at …
-
Medium 6.5
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more ti…
-
Medium 4.9
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S…
-
Medium 5.9
NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver…
-
High 7.5
IBM DataPower Gateway NULL Pointer Dereference
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
-
Medium 5.9
IBM DataPower Gateway NULL Pointer Dereference
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable proc…
-
Medium 6.5
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malformed rule structure.…
-
High 8.7
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers …
-
Medium 6.2
M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8
A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Servi…
-
Low 2.9
M17n-lib: null dereference in minput_open_im() after failed m17n_init()
A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an …
-
Medium 6.5
Security Advisory 0194
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low…
-
Medium 6.2
Sssd: sssd: denial of service via crafted passkey kerberos authentication request
A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos h…
-
Medium 5.9
Sssd: sssd: denial of service via missing sid extension in certificate mapping
A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to ve…
-
High 7.1
Starting daemon with --cdi-disabled flag can lead to panic on specific builds
If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.