cve.bz

CWE-822: Untrusted Pointer Dereference

Filter

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

What the weakness is: CWE-822 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-129 Pointer Manipulation Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-822, as MITRE names them. Credits.

Ask an AI about CWE-822

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-822: Untrusted Pointer Dereference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/822.html and https://cve.bz/cve/cwe/822?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-87041

    The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on fail…

  2. 8.8CVE-2026-16511

    Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all.…

  3. 7.0CVE-2026-115653EPSS 0.1%

    In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without ch…

  4. 6.8CVE-2026-88781EPSS 0.1%

    Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a …

  5. 7.8CVE-2026-19676EPSS 0.2%

    The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That …

  6. 6.8CVE-2026-110322EPSS 0.1%

    The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.

  7. 6.1CVE-2026-19595EPSS 0.1%

    The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out…

  8. 6.5CVE-2026-108435EPSS 0.7%

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

  9. 7.8CVE-2026-96933EPSS 0.4%

    Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-96931EPSS 0.4%

    Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

  11. 9.8CVE-2026-96924EPSS 1.0%

    Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.

  12. 5.5CVE-2026-96910EPSS 0.4%

    Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

  13. 7.8CVE-2026-96847EPSS 0.4%

    Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-96216EPSS 0.2%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  15. 8.8CVE-2026-88219EPSS 0.9%

    Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.

  16. 6.5CVE-2026-88203EPSS 0.9%

    Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  17. 7.8CVE-2026-88126EPSS 0.4%

    Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-88116EPSS 0.7%

    Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

  19. 8.8CVE-2026-88114EPSS 0.7%

    Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

  20. 8.8CVE-2026-88112EPSS 0.7%

    Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

  21. 7.0CVE-2026-88098EPSS 0.2%

    Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.

  22. 5.5CVE-2026-85909EPSS 0.4%

    Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

  23. 8.8CVE-2026-85903EPSS 0.7%

    Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

  24. 7.8CVE-2026-83848EPSS 0.4%

    Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

  25. 7.8CVE-2026-83826EPSS 0.4%

    Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-83587EPSS 0.4%

    Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

  27. 9.8CVE-2026-70300EPSS 1.1%

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  28. 9.8CVE-2026-70275EPSS 0.9%

    Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.

  29. 5.5CVE-2026-70270EPSS 0.4%

    Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.

  30. 7.8CVE-2026-70172EPSS 0.4%

    Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

  31. 6.5CVE-2026-70170EPSS 1.2%

    Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.

  32. 8.8CVE-2026-70167EPSS 1.0%

    Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.

  33. 8.1CVE-2026-70111EPSS 0.8%

    Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.

  34. 7.8CVE-2026-70104EPSS 0.4%

    Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

  35. 8.8CVE-2026-70068EPSS 0.9%

    Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.

  36. 6.7CVE-2026-69902EPSS 0.4%

    Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally.

  37. 7.8CVE-2026-69850EPSS 0.4%

    Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.

  38. 7.1CVE-2026-105729EPSS 0.4%

    Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

  39. 9.8CVE-2026-105723EPSS 1.3%

    Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

  40. 6.8CVE-2026-103578EPSS 0.5%

    Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

  41. 6.8CVE-2026-102188EPSS 0.5%

    Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.

  42. 4.7CVE-2026-102186EPSS 0.4%

    Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

  43. 7.1CVE-2026-100205EPSS 0.4%

    Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

  44. 3.6CVE-2026-96393EPSS 0.09%

    The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document t…

  45. 7.7CVE-2026-43598EPSS 0.3%

    Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code executi…

  46. 7.8CVE-2026-57545EPSS 0.08%

    Memory corruption when processing draw objects of incorrect type during graphics command list execution.

  47. 7.8CVE-2026-19185EPSS 0.2%

    The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those arra…

  48. 6.4CVE-2026-97876EPSS 0.1%

    A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by…

  49. 9.3CVE-2026-103764EPSS 0.8%

    Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can s…

  50. 8.5CVE-2026-102757EPSS 0.1%

    An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module …