CWE-476— NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.— MITRE CWE catalog
5,774 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-476page 31 of 116
- CVE-2015-8917HIGHCVSS 7.5EG 7.52016-09-20
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
- CVE-2016-7132HIGHCVSS 7.5EG 7.52016-09-12
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML docume…
- CVE-2016-7131HIGHCVSS 7.5EG 7.52016-09-12
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML docum…
- CVE-2016-7130HIGHCVSS 7.5EG 7.52016-09-12
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact…
- CVE-2016-6317HIGHCVSS 7.5EG 7.52016-09-07
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-que…
- CVE-2016-4450HIGHCVSS 7.5EG 7.52016-06-07
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to …
- CVE-2011-2482HIGHCVSS 7.5EG 7.52013-06-08
A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference …
- CVE-2011-0709HIGHCVSS 7.5EG 7.52011-02-18
The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multica…
- CVE-2009-0949HIGHCVSS 7.5EG 7.52009-06-09
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a s…
- CVE-2008-5183HIGHCVSS 7.5EG 7.52008-11-21
cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference. NOTE: this issue can …
- CVE-2008-3597HIGHCVSS 7.5EG 7.52008-08-12
Skulltag before 0.97d2-RC6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by sending a "command 29" packet when the player is not in the game.
- CVE-2007-0342HIGHCVSS 7.5EG 7.52007-01-18
WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element with a large number in the ROWSPAN attribute, as demonstrated by a crash of OmniWeb 5.5.3 on…
- CVE-2004-0079HIGHCVSS 7.5EG 7.52004-11-23
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
- CVE-2004-0458HIGHCVSS 7.5EG 7.52004-09-28
mah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference.
- CVE-2004-0365HIGHCVSS 7.5EG 7.52004-05-04
The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
- CVE-2003-1000HIGHCVSS 7.5EG 7.52004-01-05
xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.
- CVE-2003-1013HIGHCVSS 7.5EG 7.52004-01-05
The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference.
- CVE-2002-1912HIGHCVSS 7.5EG 7.52002-12-31
SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full, which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number …
- CVE-2002-0401HIGHCVSS 7.5EG 7.52002-06-18
SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause Ethereal to dereference a NULL pointer.
- CVE-1999-0052HIGHCVSS 7.5EG 7.51998-11-04
IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.
- CVE-2025-20793HIGHCVSS 6.5EG 7.52026-01-06
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges need…
- CVE-2025-20647HIGHCVSS 6.5EG 7.52025-03-03
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed…
- CVE-2023-38712HIGHCVSS 6.5EG 7.52023-08-25
An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify…
- CVE-2023-38711HIGHCVSS 6.5EG 7.52023-08-25
An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto da…
- CVE-2023-3338HIGHCVSS 6.5EG 7.52023-06-30
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
- CVE-2022-47015HIGHCVSS 6.5EG 7.52023-01-20
MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.
- CVE-2022-43972HIGHCVSS 6.5EG 7.52023-01-09
A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the soap_action function within the upnp binary can be triggered by an unauthenticat…
- CVE-2022-44792HIGHCVSS 6.5EG 7.52022-11-07
handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, …
- CVE-2022-43495HIGHCVSS 6.5EG 7.52022-11-03
OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot.
- CVE-2022-2928HIGHCVSS 6.5EG 7.52022-10-07
In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the option's refcount field. However, there is not a corresponding call to option_dere…
- CVE-2017-12124HIGHCVSS 6.5EG 7.52018-05-14
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker …
- CVE-2021-4186HIGHCVSS 6.3EG 7.52021-12-30
Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- CVE-2025-56363HIGHCVSS 5.7EG 7.52026-07-14
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks pr…
- CVE-2021-47186HIGHCVSS 5.5EG 7.52024-04-10
In the Linux kernel, the following vulnerability has been resolved: tipc: check for null after calling kmemdup kmemdup can return a null pointer so need to check for it, otherwise the null key will be dereferenced later in tipc_crypto_ke…
- CVE-2023-1355HIGHCVSS 5.5EG 7.52023-03-11
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
- CVE-2023-26916HIGHCVSS 5.3EG 7.52023-04-03
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.
- CVE-2019-1922HIGHCVSS 5.3EG 7.52019-07-06
A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to in…
- CVE-2022-3621HIGHCVSS 4.3EG 7.52022-10-20
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference…
- CVE-2021-28543HIGHCVSS 4.0EG 7.52021-03-16
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to in…
- CVE-2024-11588HIGHCVSS 3.5EG 7.52024-11-21
A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the function DoIPConnection::reactOnReceivedTcpMessage of the file DoIPConnection.cpp. The manipulation leads to null point…
- CVE-2020-36646HIGHCVSS 3.5EG 7.52023-01-07
A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to…
- CVE-2014-9660HIGHCVSS v2 7.5EG 7.52015-02-08
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified o…
- CVE-2010-3702HIGHCVSS v2 7.5EG 7.52010-11-05
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (cras…
- CVE-2026-42801HIGHCVSS 7.4EG 7.42026-09-23
NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.
- CVE-2026-20878HIGHCVSS 7.4EG 7.42026-08-11
Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enab…
- CVE-2026-20787HIGHCVSS 7.4EG 7.42026-08-11
Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enab…
- CVE-2026-40414HIGHCVSS 7.4EG 7.42026-05-12
Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-40413HIGHCVSS 7.4EG 7.42026-05-12
Windows TCP/IP Denial of Service Vulnerability
- CVE-2026-42800HIGHCVSS 7.4EG 7.42026-04-30
NULL pointer dereference vulnerability in ASR1903 in ASR Lapwing_Linux on Linux (ims_client modules) allows Pointer Manipulation. This vulnerability is associated with program files sip/utils/src/sipuri.c.
- CVE-2025-68141HIGHCVSS 7.4EG 7.42026-01-21
EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vector `<DetailedTax>tax_costs` in the target `Receipt` structu…
Map vulnerabilities like CWE-476 to your infrastructure
EchelonGraph correlates every CVE — across CWE-476 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →