Common Weakness Enumeration
CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6769 vulnerabilities reference this CWE, most recent first.
GHSA-FHFW-5P8C-4CXR
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2024-04-22 18:30
VLAI
Details
A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-14323"
],
"database_specific": {
"cwe_ids": [
"CWE-170",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-29T20:15:00Z",
"severity": "MODERATE"
},
"details": "A null pointer dereference flaw was found in samba\u0027s Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.",
"id": "GHSA-fhfw-5p8c-4cxr",
"modified": "2024-04-22T18:30:47Z",
"published": "2022-05-24T17:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14323"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891685"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JE2M4FE3N3EDXVG4UKSVFPL7SQUGFFDP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6HM73N4NEGFW5GIJJGGP6ZZBS6GTXPB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JE2M4FE3N3EDXVG4UKSVFPL7SQUGFFDP"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6HM73N4NEGFW5GIJJGGP6ZZBS6GTXPB"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202012-24"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20201103-0001"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2020-14323.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00008.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00012.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHJP-7GR5-7MH5
Vulnerability from github – Published: 2025-05-02 18:31 – Updated: 2025-11-12 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
We have to make sure that the info returned by the helper is valid before using it.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-53066"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T16:15:25Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nqed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info\n\nWe have to make sure that the info returned by the helper is valid\nbefore using it.\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE\nstatic analysis tool.",
"id": "GHSA-fhjp-7gr5-7mh5",
"modified": "2025-11-12T21:31:00Z",
"published": "2025-05-02T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53066"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/25143b6a01d0cc5319edd3de22ffa2578b045550"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/39c3b9dd481c3afce9439b29bafe00444cb4406b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/42d72c6d1edc9dc09a5d6f6695d257fa9e9cc270"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7742c08e012eb65405e8304d100641638c5ff882"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7bd0037822fd04da13721f77a42ee5a077d4c5fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/97ea704f39b5ded96f071e98701aa543f6f89683"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b224b0cab3a66e93d414825065a2e667a1d28c32"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e42d3bde4ec03c863259878dddaef5c351cca7ad"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHP4-PR5J-46M5
Vulnerability from github – Published: 2026-06-26 20:55 – Updated: 2026-06-26 20:55
VLAI
Summary
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
Details
Summary
A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process.
Affected Version
muhammara <= 6.0.4 (latest)
Vulnerability Details
File: src/deps/PDFWriter/PDFParser.cpp line 2107
if (inDecodeParams)
{
PDFObjectCastPtr<PDFInteger> earlyObj(
QueryDictionaryObject(inDecodeParams, "EarlyChange")
);
early = earlyObj->GetValue(); // NULL dereference when EarlyChange key is absent
}
When inDecodeParams is non-NULL but lacks the EarlyChange key:
1. QueryDictionaryObject() returns NULL
2. PDFObjectCastPtr<PDFInteger>(NULL) wraps NULL
3. earlyObj->GetValue() dereferences NULL → crash
PoC
460-byte malicious PDF triggers crash via startReadingFromStream():
- PDF contains
/Filter /LZWDecodewith/DecodeParms << >>(empty, no EarlyChange) - Exit code:
0xC0000005(Access Violation)
Fix
if (earlyObj)
early = earlyObj->GetValue();
Impact
Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.
Similar to: CVE-2022-41957, CVE-2022-39381
PoC File
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.4"
},
"package": {
"ecosystem": "npm",
"name": "muhammara"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-26T20:55:18Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nA NULL pointer dereference vulnerability exists in `PDFParser::CreateFilterForStream()` when processing a PDF stream with `/Filter /LZWDecode` and a `/DecodeParms` dictionary that does not contain the `EarlyChange` key. This causes an access violation (0xC0000005) and crashes the process.\n\n## Affected Version\n\nmuhammara \u003c= 6.0.4 (latest)\n\n## Vulnerability Details\n\n**File:** `src/deps/PDFWriter/PDFParser.cpp` line 2107\n\n```cpp\nif (inDecodeParams)\n{\n PDFObjectCastPtr\u003cPDFInteger\u003e earlyObj(\n QueryDictionaryObject(inDecodeParams, \"EarlyChange\")\n );\n early = earlyObj-\u003eGetValue(); // NULL dereference when EarlyChange key is absent\n}\n```\n\nWhen `inDecodeParams` is non-NULL but lacks the `EarlyChange` key:\n1. `QueryDictionaryObject()` returns NULL\n2. `PDFObjectCastPtr\u003cPDFInteger\u003e(NULL)` wraps NULL\n3. `earlyObj-\u003eGetValue()` dereferences NULL \u2192 crash\n\n## PoC\n\n460-byte malicious PDF triggers crash via `startReadingFromStream()`:\n\n- PDF contains `/Filter /LZWDecode` with `/DecodeParms \u003c\u003c \u003e\u003e` (empty, no EarlyChange)\n- Exit code: `0xC0000005` (Access Violation)\n\n## Fix\n\n```cpp\nif (earlyObj)\n early = earlyObj-\u003eGetValue();\n```\n\n## Impact\n\nAny application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS.\n\nSimilar to: CVE-2022-41957, CVE-2022-39381\n\n## PoC File\n[poc_muhammara_lzw_null.js](https://github.com/user-attachments/files/27186113/poc_muhammara_lzw_null.js)",
"id": "GHSA-fhp4-pr5j-46m5",
"modified": "2026-06-26T20:55:18Z",
"published": "2026-06-26T20:55:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-fhp4-pr5j-46m5"
},
{
"type": "WEB",
"url": "https://github.com/julianhille/MuhammaraJS/commit/a98c07780241353334eb65bfca1df025f14be70b"
},
{
"type": "PACKAGE",
"url": "https://github.com/julianhille/MuhammaraJS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"
}
GHSA-FHQ8-PVX2-R42X
Vulnerability from github – Published: 2025-04-08 21:31 – Updated: 2025-04-08 21:31
VLAI
Details
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-30300"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T19:15:50Z",
"severity": "MODERATE"
},
"details": "Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-fhq8-pvx2-r42x",
"modified": "2025-04-08T21:31:39Z",
"published": "2025-04-08T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30300"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/framemaker/apsb25-33.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHQ9-4R6P-RFM7
Vulnerability from github – Published: 2022-01-04 00:00 – Updated: 2025-05-22 21:30
VLAI
Details
The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-39988"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-03T22:15:00Z",
"severity": "HIGH"
},
"details": "The HwNearbyMain module has a NULL Pointer Dereference vulnerability.Successful exploitation of this vulnerability may cause a process to restart.",
"id": "GHSA-fhq9-4r6p-rfm7",
"modified": "2025-05-22T21:30:33Z",
"published": "2022-01-04T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39988"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202111-0000001217889667"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHVG-P495-PHCG
Vulnerability from github – Published: 2026-09-30 06:31 – Updated: 2026-10-06 18:31
VLAI
Details
A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-86134"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T04:18:33Z",
"severity": "HIGH"
},
"details": "A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.",
"id": "GHSA-fhvg-p495-phcg",
"modified": "2026-10-06T18:31:22Z",
"published": "2026-09-30T06:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86134"
},
{
"type": "WEB",
"url": "https://psirt.watchguard.com/CVE-2026-86134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FHX3-MXF6-JXPV
Vulnerability from github – Published: 2024-04-09 00:30 – Updated: 2026-07-05 15:30
VLAI
Details
ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate).
Severity
{
"affected": [],
"aliases": [
"CVE-2024-23081"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T23:15:07Z",
"severity": "LOW"
},
"details": "ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate).",
"id": "GHSA-fhx3-mxf6-jxpv",
"modified": "2026-07-05T15:30:26Z",
"published": "2024-04-09T00:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23081"
},
{
"type": "WEB",
"url": "https://gist.github.com/LLM4IG/3cc9183dcd887020368a0bafeafec5e3"
},
{
"type": "WEB",
"url": "https://github.com/ThreeTen/threetenbp"
},
{
"type": "WEB",
"url": "http://threeten.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FJ5P-97V6-XC59
Vulnerability from github – Published: 2022-05-14 02:00 – Updated: 2022-05-14 02:00
VLAI
Details
A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-17432"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-24T14:29:00Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.",
"id": "GHSA-fj5p-97v6-xc59",
"modified": "2022-05-14T02:00:08Z",
"published": "2022-05-14T02:00:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17432"
},
{
"type": "WEB",
"url": "https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln6#null-pointer-dereference-in-h5o_sdspace_encode"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ5W-H5XF-6HCH
Vulnerability from github – Published: 2022-05-17 02:47 – Updated: 2025-04-20 03:35
VLAI
Details
illumos smbsrv NULL pointer dereference allows system crash.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2016-6561"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-31T19:59:00Z",
"severity": "HIGH"
},
"details": "illumos smbsrv NULL pointer dereference allows system crash.",
"id": "GHSA-fj5w-h5xf-6hch",
"modified": "2025-04-20T03:35:04Z",
"published": "2022-05-17T02:47:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6561"
},
{
"type": "WEB",
"url": "https://github.com/illumos/illumos-gate/commit/6d1c73b5858fefc6161c7d686345f0dc887ea799"
},
{
"type": "WEB",
"url": "https://www.illumos.org/issues/7483"
},
{
"type": "WEB",
"url": "https://www.openindiana.org/2016/11/01/cve-2016-6560-cve-2016-6561-security-issues-in-illumos"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98079"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ7W-QW6P-VG55
Vulnerability from github – Published: 2025-09-26 15:30 – Updated: 2025-09-26 15:30
VLAI
Details
A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLogManager.cpp. Performing manipulation of the argument mDefaultLog results in null pointer dereference. The attack must be initiated from a local position. The exploit is now public and may be used.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-11017"
],
"database_specific": {
"cwe_ids": [
"CWE-404",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T14:15:42Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in OGRECave Ogre up to 14.4.1. The impacted element is the function Ogre::LogManager::stream of the file /ogre/OgreMain/src/OgreLogManager.cpp. Performing manipulation of the argument mDefaultLog results in null pointer dereference. The attack must be initiated from a local position. The exploit is now public and may be used.",
"id": "GHSA-fj7w-qw6p-vg55",
"modified": "2025-09-26T15:30:28Z",
"published": "2025-09-26T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11017"
},
{
"type": "WEB",
"url": "https://github.com/OGRECave/ogre/issues/3447"
},
{
"type": "WEB",
"url": "https://github.com/user-attachments/files/22335685/poc.zip"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.325960"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.325960"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.654456"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation MIT-56
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Requirements
Select a programming language that is not susceptible to these issues.
Mitigation
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.