cve.bz

CWE-476: NULL Pointer Dereference, page 7

Filter

The product dereferences a pointer that it expects to be valid but is NULL.

What the weakness is: CWE-476 at MITRE

Ask an AI about CWE-476

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-476: NULL Pointer Dereference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/476.html and https://cve.bz/cve/cwe/476?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2026-76922EPSS 0.1%

    Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

  2. 5.5CVE-2026-76881EPSS 0.1%

    CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

  3. 6.5CVE-2026-68901EPSS 0.5%

    Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models…

  4. 6.5CVE-2026-16846EPSS 0.3%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a null pointer dereference.

  5. 5.3CVE-2026-16829EPSS 0.2%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

  6. 7.1CVE-2026-75618EPSS 0.4%

    Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service …

  7. 7.5CVE-2026-16817EPSS 0.5%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

  8. 4.3CVE-2026-76166EPSS 1.0%

    A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" he…

  9. 1.9CVE-2026-76014EPSS 0.2%

    A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer derefer…

  10. 5.3CVE-2026-73502EPSS 0.5%

    kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/js…

  11. 4.0CVE-2026-50126EPSS 0.2%

    Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety…

  12. 6.5CVE-2026-59949EPSS 0.5%

    yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nat…

  13. 5.7CVE-2026-75013EPSS 0.7%

    A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation results in null pointer dereference. The attack can be launched remotely. The…

  14. 5.7CVE-2026-75012EPSS 0.7%

    A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation …

  15. 4.0CVE-2026-58561EPSS 0.1%

    Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.

  16. 4.0CVE-2026-58560EPSS 0.1%

    Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.

  17. 7.8CVE-2026-72036EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call …

  18. 8.2CVE-2026-72035EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stas…

  19. 7.8CVE-2026-72034EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capable_wrt_mount() The recent fhandle RCU fix moved the mount namespace capability check into capable_wrt_mount(), so a non-NULL mnt_…

  20. 6.9CVE-2026-55401EPSS 0.4%

    CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which resul…

  21. 6.0CVE-2026-18699EPSS 0.4%

    An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. Th…

  22. 7.5CVE-2026-65681EPSS 1.2%

    Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

  23. 8.6CVE-2026-62702EPSS 1.0%

    Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network.

  24. 6.5CVE-2026-61345EPSS 1.1%

    Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

  25. 6.5CVE-2026-59138EPSS 1.1%

    Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

  26. 7.5CVE-2026-59132EPSS 1.2%

    Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

  27. 7.5CVE-2026-48438EPSS 0.9%

    CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service co…

  28. 7.1CVE-2026-20878EPSS 0.3%

    Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enab…

  29. 7.1CVE-2026-20787EPSS 0.3%

    Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enab…

  30. 8.3CVE-2026-20727EPSS 0.6%

    Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack ma…

  31. 6.5CVE-2026-18638EPSS 0.4%

    Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

  32. 4.6CVE-2026-12051EPSS 0.2%

    The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->…

  33. 3.9CVE-2026-19411EPSS 0.1%

    A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

  34. 7.5CVE-2026-11810EPSS 0.5%

    The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validat…

  35. 5.7CVE-2026-71967EPSS 0.2%

    OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA open_session handler that allows Normal World clients to cause a denial of service when CFG_WIDEVINE_PTA is enab…

  36. 9.8CVE-2026-68385EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csum_partial() without vector facility Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facilit…

  37. 8.8CVE-2026-68354EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to a…

  38. 7.8CVE-2026-68305EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the…

  39. 7.5CVE-2026-68157EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry i…

  40. 7.5CVE-2026-68141EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The c…

  41. 9.8CVE-2026-68136EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(…

  42. 7.5CVE-2026-72582EPSS 0.6%

    A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer …

  43. 7.5CVE-2026-17510EPSS 0.6%

    Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byt…

  44. 7.5CVE-2026-52878EPSS 0.5%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission cau…

  45. 5.3CVE-2026-19012EPSS 0.3%

    Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. …

  46. 7.8CVE-2026-48097EPSS 0.2%

    NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on…

  47. 5.5CVE-2026-45204EPSS 0.2%

    Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running…

  48. 7.3CVE-2026-70640EPSS 0.2%

    llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while T…

  49. 6.8CVE-2026-70639EPSS 0.2%

    llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can sup…

  50. 9.8CVE-2026-67870EPSS 1.1%

    In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a no…