cve.bz

CWE-476: NULL Pointer Dereference, page 3

Filter

The product dereferences a pointer that it expects to be valid but is NULL.

What the weakness is: CWE-476 at MITRE

Ask an AI about CWE-476

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-476: NULL Pointer Dereference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/476.html and https://cve.bz/cve/cwe/476?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2026-103824EPSS 0.1%

    Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service con…

  2. 5.5CVE-2026-103855EPSS 0.1%

    Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Explo…

  3. 5.5CVE-2026-103852EPSS 0.1%

    Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condi…

  4. 8.8CVE-2026-97767EPSS 0.6%

    Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-96953EPSS 0.3%

    Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

  6. 7.0CVE-2026-88079EPSS 0.3%

    Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  7. 7.0CVE-2026-88076EPSS 0.3%

    Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.

  8. 6.5CVE-2026-85859EPSS 0.8%

    Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.

  9. 7.5CVE-2026-84017EPSS 1.1%

    Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

  10. 7.5CVE-2026-83665EPSS 1.3%

    Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  11. 6.5CVE-2026-83648EPSS 1.2%

    Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

  12. 6.5CVE-2026-83636EPSS 0.4%

    Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

  13. 5.5CVE-2026-83571EPSS 0.5%

    Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.

  14. 7.8CVE-2026-70566EPSS 0.4%

    Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally.

  15. 6.5CVE-2026-70248EPSS 0.4%

    Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

  16. 5.5CVE-2026-69978EPSS 0.4%

    Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.

  17. 7.0CVE-2026-69795EPSS 0.3%

    Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

  18. 5.5CVE-2026-104343EPSS 0.2%

    Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition…

  19. 7.1CVE-2026-104004EPSS 0.2%

    MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur fo…

  20. 7.5CVE-2026-95122EPSS 0.5%

    mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

  21. 7.1CVE-2026-77095EPSS 0.2%

    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Client…

  22. 8.7CVE-2026-109967EPSS 0.6%

    yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value lik…

  23. 7.1CVE-2026-109942EPSS 0.3%

    FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header-only PKT_TYPE_CLOSE_CHANNEL packet and passes the null payload without …

  24. 7.1CVE-2026-109939EPSS 0.3%

    FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_cache_bitmap_v3_order() in libfreerdp/core/orders.c, which accesses the client bitmap cache when the CBR3_DO_NOT_CACHE flag is set, even though the cache is no…

  25. 6.0CVE-2026-109679EPSS 0.3%

    FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL…

  26. 5.5CVE-2026-109107EPSS 0.4%

    A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to …

  27. 2.0CVE-2026-109280EPSS 0.1%

    ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure c…

  28. 6.3CVE-2026-109272EPSS 0.4%

    ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, ca…

  29. 2.0CVE-2026-109258EPSS 0.1%

    ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an inv…

  30. 6.0CVE-2026-109252EPSS 0.3%

    FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthentic…

  31. 2.3CVE-2026-109241EPSS 0.2%

    FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message th…

  32. 5.5CVE-2026-19737EPSS 0.1%

    i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking th…

  33. 5.5CVE-2026-108093EPSS 0.1%

    A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simu…

  34. 5.4CVE-2026-104114EPSS 0.1%

    A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking t…

  35. 5.5CVE-2026-108063EPSS 0.1%

    A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an …

  36. 4.0CVE-2026-107655EPSS 0.3%

    A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit…

  37. 5.5CVE-2026-107890EPSS 0.1%

    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to …

  38. 5.5CVE-2026-107888EPSS 0.1%

    OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destin…

  39. 6.8CVE-2026-107733EPSS 0.2%

    SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive …

  40. 7.1CVE-2026-107778EPSS 0.4%

    MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded cred…

  41. 6.9CVE-2026-107708EPSS 0.5%

    MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trust…

  42. 7.5CVE-2026-16165EPSS 0.3%

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.

  43. 5.9CVE-2026-107613EPSS 0.3%

    A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Deskto…

  44. 5.9CVE-2026-16182EPSS 0.3%

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in G…

  45. 6.5CVE-2026-107222EPSS 0.3%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malfo…

  46. 8.7CVE-2026-107213EPSS 0.2%

    Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exis…

  47. 6.2CVE-2026-107169EPSS 0.1%

    A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting …

  48. 2.9CVE-2026-107170EPSS 0.1%

    A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application at…

  49. 7.1CVE-2026-102169EPSS 0.3%

    On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts,…

  50. 6.2CVE-2026-104044EPSS 0.1%

    A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check i…