Weakness (CWE)
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it (5 mitigations)
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Requirements
Select a programming language that is not susceptible to these issues.
-
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
Source: MITRE CWE-476
2,672 results · Feed
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL…
-
Medium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL po…
-
Medium 6.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for priv…
-
High 7.5CVE-2021-34586 EPSS 14%
CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
-
Medium 6.1
XMP Toolkit SDK Null Pointer Dereference
XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory locations and causing a local denial of service in the context of the current user. User interaction is requ…
-
Medium 6.5
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3
-
Unscored —
A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Grantin…
-
Low 2.3
A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference.
-
Medium 6.5
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zeph…
-
Unscored —CVE-2021-41524 EPSS 26%
null pointer dereference in h2 fuzzing
While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49…
-
Medium 5.5
Adobe Acrobat Reader DC Search Plugin Null Pointer Dereference
Acrobat Pro DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive u…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
Medium 5.5
Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service
Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x0b
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x07
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
-
Unscored —CVE-2021-34798 EPSS 65%
NULL pointer dereference in httpd core
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
-
Low 3.3
NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory c…
-
Low 3.3
NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory c…
-
Medium 5.8
Cisco IOS XR Software DHCP Version 4 Server Denial of Service Vulnerability
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerability exists because…
-
Medium 6.7
A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.
-
Medium 6.5
A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / …
-
Low 3.3
Adobe After Effects NULL Pointer Dereference vulnerability
Adobe After Effects version 18.2 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the cont…
-
Medium 5.5
Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability achieve an application…
-
Medium 5.5
Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an applic…
-
High 7.8
Null pointer exception in TensorFlow Lite
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/ten…
-
High 7.8
Null pointer dereference in TensorFlow Lite MLIR optimizations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR opt…
-
High 7.8
Null pointer dereference in TensorFlow Lite
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://g…
-
High 7.8
Incorrect validation of `SaveV2` inputs in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the code for `tf.raw_ops.SaveV2` does not properly validate the inputs and an attacker can trigger a null pointer dereference. The [implementation](https://github.com/…
-
High 7.3
Out of bounds read via null pointer dereference in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of bin…
-
High 7.7
Null pointer dereference in `CompressElement` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to `tf.raw_ops.CompressElement`. The [implementation](https://github.com/tensorflow/tensorflo…
-
High 7.7
Null pointer dereference in `UncompressElement` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181…
-
High 7.7
Null pointer dereference in `SparseTensorSliceDataset` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer. The [implementat…
-
High 7.7
Null pointer dereference in `MatrixDiagPartOp` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignor…
-
High 8.4
Null pointer dereference and heap OOB read in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer. Alternatively, attackers can read memory outside the b…