CWE-476— NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.— MITRE CWE catalog
5,799 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-476page 47 of 116
- CVE-2023-3316MEDIUMCVSS 5.9EG 5.92023-06-19
A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.
- CVE-2022-43603MEDIUMCVSS 5.9EG 5.92022-12-22
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file …
- CVE-2022-43595MEDIUMCVSS 5.9EG 5.92022-12-22
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can p…
- CVE-2022-43594MEDIUMCVSS 5.9EG 5.92022-12-22
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can p…
- CVE-2022-43593MEDIUMCVSS 5.9EG 5.92022-12-22
A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An attacker can provide malicious in…
- CVE-2022-36014MEDIUMCVSS 5.9EG 5.92022-09-16
TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21…
- CVE-2022-36013MEDIUMCVSS 5.9EG 5.92022-09-16
TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f…
- CVE-2022-36011MEDIUMCVSS 5.9EG 5.92022-09-16
TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8…
- CVE-2022-36000MEDIUMCVSS 5.9EG 5.92022-09-16
TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit aed36912609fc0722…
- CVE-2022-35965MEDIUMCVSS 5.9EG 5.92022-09-16
TensorFlow is an open source platform for machine learning. If `LowerBound` or `UpperBound` is given an empty`sorted_inputs` input, it results in a `nullptr` dereference, leading to a segfault that can be used to trigger a denial of servic…
- CVE-2022-29224MEDIUMCVSS 5.9EG 5.92022-06-09
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy a…
- CVE-2021-3320MEDIUMCVSS 5.9EG 5.92021-05-25
Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-27r3-rxch-2hm7
- CVE-2021-3537MEDIUMCVSS 5.9EG 5.92021-05-14
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the…
- CVE-2021-23841MEDIUMCVSS 5.9EG 5.92021-02-16
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may …
- CVE-2020-1971MEDIUMCVSS 5.9EG 5.92020-12-08
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to …
- CVE-2020-26213MEDIUMCVSS 5.9EG 5.92020-11-06
In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. …
- CVE-2020-15209MEDIUMCVSS 5.9EG 5.92020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer ser…
- CVE-2020-16135MEDIUMCVSS 5.9EG 5.92020-07-29
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
- CVE-2020-16117MEDIUMCVSS 5.9EG 5.92020-07-29
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capabi…
- CVE-2020-10600MEDIUMCVSS 5.9EG 5.92020-07-24
An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive (2018 SP2 and prior versions).
- CVE-2020-10711MEDIUMCVSS 5.9EG 5.92020-05-22
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bit…
- CVE-2019-19242MEDIUMCVSS 5.9EG 5.92019-11-27
SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
- CVE-2019-11555MEDIUMCVSS 5.9EG 5.92019-04-26
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result i…
- CVE-2019-11366MEDIUMCVSS 5.9EG 5.92019-04-20
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer de…
- CVE-2018-1172MEDIUMCVSS 5.9EG 5.92018-05-16
This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within Cl…
- CVE-2018-1302MEDIUMCVSS 5.9EG 5.92018-03-26
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabi…
- CVE-2015-5316MEDIUMCVSS 5.9EG 5.92018-02-21
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereferenc…
- CVE-2015-6569MEDIUMCVSS 5.9EG 5.92018-02-21
Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and thread crash) via a state manipulation attack.
- CVE-2017-16914MEDIUMCVSS 5.9EG 5.92018-01-31
The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB…
- CVE-2017-11063MEDIUMCVSS 5.9EG 5.92017-10-10
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a result of a race condition between two userspace processes that interact with the driver concurrently, a null pointer dere…
- CVE-2015-8762MEDIUMCVSS 5.9EG 5.92017-03-27
The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a zero-length EAP-PWD packet.
- CVE-2017-0016MEDIUMCVSS 5.9EG 5.92017-03-17
Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets, which allows remote attackers to execute arbitrary …
- CVE-2015-7977MEDIUMCVSS 5.9EG 5.92017-01-30
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
- CVE-2016-9311MEDIUMCVSS 5.9EG 5.92017-01-13
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.
- CVE-2016-2369MEDIUMCVSS 5.9EG 5.92017-01-06
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a pa…
- CVE-2016-2365MEDIUMCVSS 5.9EG 5.92017-01-06
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercep…
- CVE-2016-5354MEDIUMCVSS 5.9EG 5.92016-08-07
The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
- CVE-2016-6504MEDIUMCVSS 5.9EG 5.92016-08-06
epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a ptvc data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and applicati…
- CVE-2026-24929MEDIUMCVSS 4.4EG 5.92026-02-06
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
- CVE-2023-1587MEDIUMCVSS 5.8EG 5.82023-04-19
Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus version 22.11
- CVE-2021-34737MEDIUMCVSS 5.8EG 5.82021-09-09
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerab…
- CVE-2026-63380MEDIUMCVSS 5.7EG 5.72026-08-20
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws…
- CVE-2026-48066MEDIUMCVSS 5.7EG 5.72026-05-27
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is written on every PAM invocation with the address of a stack-local variable. This vi…
- CVE-2025-24179MEDIUMCVSS 5.7EG 5.72025-04-29
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3. An attacker on…
- CVE-2022-49138MEDIUMCVSS 5.7EG 5.72025-02-26
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Ignore multiple conn complete events When one of the three connection complete events is received multiple times for the same handle, the device is…
- CVE-2024-42491MEDIUMCVSS 5.7EG 5.72024-09-05
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose ho…
- CVE-2023-4875MEDIUMCVSS 5.7EG 5.72023-09-09
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
- CVE-2020-12866MEDIUMCVSS 5.7EG 5.72020-06-24
A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.
- CVE-2022-3563MEDIUMCVSS 3.5EG 5.72022-10-17
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to nu…
- CVE-2011-1478MEDIUMCVSS v2 5.7EG 5.72011-10-23
The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denia…
Map vulnerabilities like CWE-476 to your infrastructure
EchelonGraph correlates every CVE — across CWE-476 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →