Weakness (CWE)
CWE-822: Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Source: MITRE CWE-822
378 results · Feed
-
High 7.0
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Graphics Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Audio Service Elevation of Privilege Vulnerability
Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Graphics Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Smart Card Elevation of Privilege Vulnerability
Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Windows Storage Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Storage allows an authorized attacker to elevate privileges with a physical attack.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Connection Manager Service Elevation of Privilege Vulnerability
Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 6.8
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.
-
High 8.4
Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS…
-
Medium 5.9
Untrusted pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a d…
-
High 7.8
CVE-2026-90975
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property r…
-
High 8.2
Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…
-
Critical 9.3
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied st…
-
High 7.8
Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on …
-
High 8.8
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller…
-
High 7.0
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer …
-
Medium 6.8
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an…
-
High 7.8
PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the o…
-
Medium 5.5
HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
-
Medium 6.1
Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_…
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 6.8
Windows Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.