Weakness (CWE)
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it (5 mitigations)
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Requirements
Select a programming language that is not susceptible to these issues.
-
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
-
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
-
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
Source: MITRE CWE-476
2,667 results · Feed
-
Medium 6.5
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a…
-
Medium 6.2CVE-2026-86547 Public exploit
mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embeddi…
-
Medium 6.5
Skype for Business and Lync Denial of Service Vulnerability
Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
Medium 5.3
Windows Schannel Denial of Service Vulnerability
Null pointer dereference in Windows Schannel allows an authorized attacker to deny service over a network.
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
-
High 7.1
Virtual Hard Disk (VHD) Miniport Driver Denial of Service Vulnerability
Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an unauthorized attacker to deny service locally.
-
Medium 6.5
Windows Active Directory Domain Services Denial of Service Vulnerability
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
-
High 7.5
Windows SMB Server Network Transport Driver (srvnet.sys) Denial of Service Vulnerability
Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.
-
High 7.5
Windows Kerberos Denial of Service Vulnerability
Null pointer dereference in Windows Kerberos allows an unauthorized attacker to deny service over a network.
-
High 7.5
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
-
Low 2.5
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all …
-
Medium 6.5
Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry par…
-
High 7.5
389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACK…
-
Medium 6.5
PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup'…
-
High 7.1
PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL wi…
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in Debug Server
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.
-
High 7.5
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
-
High 7.5
Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's term…
-
Medium 5.9
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL…
-
High 7.5
NGINX ngx_http_js_module vulnerability
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: …
-
Medium 5.5
NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mT…
-
Medium 4.3
FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remo…
-
Medium 5.3
armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference
A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_string_ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer…
-
Medium 4.3
Open5GS Transfer Endpoint namf-handler.c null pointer dereference
A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. …
-
Medium 5.3
Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. …
-
Medium 5.3
Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successfu…
-
High 7.7
MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message…
-
Medium 4.9
PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, …
-
Medium 4.9
PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post
PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote au…
-
Medium 5.3
Wazuh agent enrollment NULL pointer dereference via malformed manager response
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning…
-
High 7.5
A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 all…
-
High 7.5
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of…
-
High 7.5
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (…
-
High 7.5
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Den…
-
High 7.5
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_han…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg()…