CWE-170: Improper Null Termination
Filter
The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
What the weakness is: CWE-170 at MITRE. All weaknesses
Ask an AI about CWE-170
Show the prompt
Explain CWE-170: Improper Null Termination and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/170.html and https://cve.bz/cve/cwe/170?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.3CVE-2026-121943EPSS 5.6%
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP…
- 6.5CVE-2026-57185EPSS 0.5%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer ove…
- 3.7CVE-2026-114457EPSS 0.4%
A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing…
- 5.5CVE-2026-96860EPSS 0.4%
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-96850EPSS 0.4%
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
- 7.8CVE-2026-83781EPSS 0.4%
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
- 6.1CVE-2026-81882EPSS 0.2%
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF…
- 5.3CVE-2026-73324EPSS 0.2%
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a li…
- 5.5CVE-2026-78506EPSS 0.5%
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- 7.5CVE-2026-70587EPSS 1.0%
Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
- 7.5CVE-2026-45798EPSS 0.9%
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field i…
- 7.8CVE-2026-72095EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: dma-fence: Make dma_fence_dedup_array() robust against 0-count input dma_fence_dedup_array() returns 1 when called with num_fences == 0: the for-loop body never executes…
- 8.4CVE-2026-63860EPSS 0.2%
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either…
- 5.9CVE-2026-44452EPSS 0.4%
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hos…
- 3.9CVE-2026-12386EPSS 0.1%
Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.
- 8.7CVE-2026-55738EPSS 0.4%
A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the …
- 9.8CVE-2026-5067EPSS 0.6%
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a boun…
- 9.8CVE-2026-8721EPSS 0.4%
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded.…
- 9.8CVE-2026-42010EPSS 1.1%
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specia…
- 8.8CVE-2026-34464EPSS 0.2%
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer usin…
- 7.3CVE-2026-34462EPSS 0.2%
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from …
- 5.3CVE-2026-34032EPSS 0.5%
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
- 7.1CVE-2026-43028EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most…
- 3.5CVE-2026-40334EPSS 0.2%
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buff…
- 2.9CVE-2026-33948EPSS 0.3%
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses st…
- 6.5CVE-2026-2239EPSS 0.5%
A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Document) file. This occurs because the buffer allocated for a Pascal string is not …
- 5.1CVE-2026-32837EPSS 0.2%
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WA…
- 2.1CVE-2026-23749EPSS 0.2%
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG…
- 7.1CVE-2026-27692EPSS 0.2%
iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap…
- 7.1CVE-2025-67733EPSS 0.6%
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corruptin…
- 8.1CVE-2026-24852EPSS 0.3%
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a no…
- 7.1CVE-2026-21488EPSS 0.1%
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText:…
- 7.1CVE-2025-2026EPSS 0.4%
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and resu…
- 7.5CVE-2025-67790EPSS 0.3%
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated str…
- 7.1CVE-2025-66220EPSS 0.2%
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte…
- 6.9CVE-2025-62792EPSS 0.4%
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not b…
- 5.5CVE-2025-61912EPSS 0.5%
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4…
- 7.5CVE-2024-31197EPSS 0.3%
Improper Null Termination vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of10::Port:unpack. This issue affects libfluid: 0.1.0.
- 7.5CVE-2024-43474EPSS 1.3%
Microsoft SQL Server Information Disclosure Vulnerability
- 8.4CVE-2024-45288EPSS 0.3%
A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.
- 7.3CVE-2024-31484EPSS 0.5%
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Et…
- 7.8CVE-2024-21442EPSS 0.8%
Windows USB Print Driver Elevation of Privilege Vulnerability
- 4.9CVE-2023-48674EPSS 0.5%
Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send malicious data to the device in order to cause some services to cease to function.
- 7.5CVE-2023-36907EPSS 1.7%
Windows Cryptographic Services Information Disclosure Vulnerability
- 7.5CVE-2023-36906EPSS 2.0%
Windows Cryptographic Services Information Disclosure Vulnerability
- 6.5CVE-2023-35321EPSS 1.6%
Windows Deployment Services Denial of Service Vulnerability
- 5.5CVE-2023-28263EPSS 0.6%
Visual Studio Information Disclosure Vulnerability
- 7.5CVE-2023-24021EPSS 0.9%
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collect…
- 7.5CVE-2022-47515EPSS 1.2%
An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
- 8.8CVE-2021-31888EPSS 2.4%
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…