CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6769 vulnerabilities reference this CWE, most recent first.
GHSA-8Q43-5443-JCQ2
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 18:30In the Linux kernel, the following vulnerability has been resolved:
mmc: moxart: fix return value check of mmc_add_host()
mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path.
So fix this by checking the return value and goto error path which will call mmc_free_host().
{
"affected": [],
"aliases": [
"CVE-2022-50268"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:37Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: moxart: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host().",
"id": "GHSA-8q43-5443-jcq2",
"modified": "2025-12-03T18:30:20Z",
"published": "2025-09-15T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50268"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0ca18d09c744fb030ae9bc5836c3e357e0237dea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40aa73c70e8a5706f9cbe01409a5e51cc0f1750e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c3b301ca8b0cab392c71da8fcdfa499074f8e97"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f8bb62c7c5c833758ef1563fe738afd579c3efe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a4c765f5d8e58138cff69f1510b2e8942ec37022"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a94d466f31a5201995d39bc1208e2c09ab04f0bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b174f2b36c638fc7737df6c8aac1889a646be98f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c7e9a2059fb943fc3c3fa12261518fd72a0fc136"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f0502fe86a2db2336c9498d2de3e97f22dcf85ae"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8Q8P-VXJ6-FG2G
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2025-04-12 13:02The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
{
"affected": [],
"aliases": [
"CVE-2016-3120"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-08-01T02:59:00Z",
"severity": "MODERATE"
},
"details": "The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.",
"id": "GHSA-8q8p-vxj6-fg2g",
"modified": "2025-04-12T13:02:56Z",
"published": "2022-05-13T01:28:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3120"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35"
},
{
"type": "WEB",
"url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8458"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00035.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2591.html"
},
{
"type": "WEB",
"url": "http://web.mit.edu/kerberos/krb5-1.13"
},
{
"type": "WEB",
"url": "http://web.mit.edu/kerberos/krb5-1.14"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92132"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036442"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8Q9P-R3G4-95MR
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-09-03 18:31In the Linux kernel, the following vulnerability has been resolved:
crypto: chacha20poly1305 - validate poly1305 template argument
chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().
When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().
This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.
{
"affected": [],
"aliases": [
"CVE-2026-64314"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T10:17:12Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: chacha20poly1305 - validate poly1305 template argument\n\nchachapoly_create() still accepts the compatibility poly1305 parameter\nin the template name, but it assumes the second template argument is\nalways present and immediately passes it to strcmp().\n\nWhen the argument is missing, crypto_attr_alg_name() returns an error\npointer. Check for that before comparing the name so malformed template\ninstantiations fail with an error instead of dereferencing the error\npointer in strcmp().\n\nThis matches the surrounding Crypto API template pattern where\ncrypto_attr_alg_name() results are validated before string-specific use.",
"id": "GHSA-8q9p-r3g4-95mr",
"modified": "2026-09-03T18:31:16Z",
"published": "2026-07-25T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64314"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0016d3c21c6ab60a20be7f565cefb5999f3adeb6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/265b861bece38318b8e0fc8fac0643d4ef906d31"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e74df53b36cdc6b6b9e5488ec883d1d55624737f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QCX-8Q3J-2W4J
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2024-04-04 01:19An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object from a document, or parsing a certain portfolio that contains a null dictionary.
{
"affected": [],
"aliases": [
"CVE-2019-14208"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-21T19:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object from a document, or parsing a certain portfolio that contains a null dictionary.",
"id": "GHSA-8qcx-8q3j-2w4j",
"modified": "2024-04-04T01:19:33Z",
"published": "2022-05-24T16:50:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14208"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QFC-4842-RRWJ
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function GString::~GString() located in GString.cc. It allows an attacker to cause Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2021-39559"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-20T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function GString::~GString() located in GString.cc. It allows an attacker to cause Denial of Service.",
"id": "GHSA-8qfc-4842-rrwj",
"modified": "2022-05-24T19:15:06Z",
"published": "2022-05-24T19:15:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39559"
},
{
"type": "WEB",
"url": "https://github.com/matthiaskramm/swftools/issues/101"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QGV-WM66-HRMC
Vulnerability from github – Published: 2026-04-28 06:30 – Updated: 2026-07-14 15:31In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
{
"affected": [],
"aliases": [
"CVE-2026-40355"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T06:16:03Z",
"severity": "MODERATE"
},
"details": "In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.",
"id": "GHSA-8qgv-wm66-hrmc",
"modified": "2026-07-14T15:31:55Z",
"published": "2026-04-28T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40355"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f"
},
{
"type": "WEB",
"url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://web.mit.edu/kerberos/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QPF-RMPC-XXMW
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-11-03 21:31In the Linux kernel, the following vulnerability has been resolved:
cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
cpufreq_cpu_get_raw() may return NULL if the cpu is not in policy->cpus cpu mask and it will cause null pointer dereference, so check NULL for cppc_get_cpu_cost().
{
"affected": [],
"aliases": [
"CVE-2024-53230"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T14:15:31Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()\n\ncpufreq_cpu_get_raw() may return NULL if the cpu is not in\npolicy-\u003ecpus cpu mask and it will cause null pointer dereference,\nso check NULL for cppc_get_cpu_cost().",
"id": "GHSA-8qpf-rmpc-xxmw",
"modified": "2025-11-03T21:31:50Z",
"published": "2024-12-27T15:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53230"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1975b481f644f8f841d9c188e3c214fce187f18b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a1374bb8c5926674973d849feed500bc61ad535"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6be57617a38b3f33266acecdb3c063c1c079aaf7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/afd22d9839359829776abb55cc9bc4946e888704"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f05ef81db63889f6f14eb77fd140dac6cedb6f7f"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QQ6-RP62-86QV
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function node::BDCNode::~BDCNode() located in bdcnode.cpp. It allows an attacker to cause Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2021-39539"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-20T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in pdftools through 20200714. A NULL pointer dereference exists in the function node::BDCNode::~BDCNode() located in bdcnode.cpp. It allows an attacker to cause Denial of Service.",
"id": "GHSA-8qq6-rp62-86qv",
"modified": "2022-05-24T19:15:09Z",
"published": "2022-05-24T19:15:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39539"
},
{
"type": "WEB",
"url": "https://github.com/leonhad/pdftools/issues/6"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8QQ9-W6JC-22XX
Vulnerability from github – Published: 2025-03-18 21:31 – Updated: 2025-03-18 21:31In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Check for potential null return of kmalloc_array()
As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion.
{
"affected": [],
"aliases": [
"CVE-2022-49055"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T07:00:42Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check for potential null return of kmalloc_array()\n\nAs the kmalloc_array() may return null, the \u0027event_waiters[i].wait\u0027 would lead to null-pointer dereference.\nTherefore, it is better to check the return value of kmalloc_array() to avoid this confusion.",
"id": "GHSA-8qq9-w6jc-22xx",
"modified": "2025-03-18T21:31:59Z",
"published": "2025-03-18T21:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49055"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0a692c625e373fef692ffbc7fc41f8a025f01cb7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1d7a5aae884ca727d41c7ed15d4c82fdb67c040c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/32cf90a521dcc0f136db7ee5ba32bfe5f79e460e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40bf32dbfef866c83a3e74800b81d79e52b6d20b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/94869bb0de69a812f70231b0eb480bb2f7ae73a6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c7a268b33882d5feaafd29c1734456f41ba41396"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ebbb7bb9e80305820dc2328a371c1b35679f2667"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f2658d5966bcee8c3eb487875f459756d4f7cdfc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QQW-CCJH-QMVF
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-13 00:31A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2024-37826"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:23Z",
"severity": "HIGH"
},
"details": "A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.",
"id": "GHSA-8qqw-ccjh-qmvf",
"modified": "2024-08-13T00:31:42Z",
"published": "2024-08-12T15:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37826"
},
{
"type": "WEB",
"url": "https://gist.github.com/Evian-Zhang/4453e7ac0da7cfa421c76c5ab514dba4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.