CWE-822— Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.— MITRE CWE catalog
227 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-822page 5 of 5
- CVE-2026-40367HIGHCVSS 8.4EG 8.42026-05-12
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-40369HIGHCVSS 7.8EG 7.82026-05-12
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-44805MEDIUMCVSS 5.5EG 5.52026-06-09
Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.
- CVE-2026-45198HIGHCVSS 7.8EG 7.82026-08-07
Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from n…
- CVE-2026-45471HIGHCVSS 7.8EG 7.82026-06-09
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-45643HIGHCVSS 7.8EG 7.82026-06-09
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-45645HIGHCVSS 7.8EG 7.82026-06-09
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-48137CRITICALCVSS 9.8EG 9.82026-06-19
There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploita…
- CVE-2026-48340HIGHCVSS 7.8EG 7.82026-07-14
Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malici…
- CVE-2026-48580MEDIUMCVSS 5.5EG 5.52026-07-14
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- CVE-2026-50367HIGHCVSS 7.8EG 7.82026-07-14
Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-50382HIGHCVSS 8.8EG 8.82026-07-14
Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.
- CVE-2026-50424HIGHCVSS 7.5EG 7.52026-07-14
Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a network.
- CVE-2026-50441HIGHCVSS 7.8EG 7.82026-07-14
Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-50479HIGHCVSS 7.8EG 7.82026-07-14
Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-55136HIGHCVSS 7.8EG 7.82026-07-14
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-55138MEDIUMCVSS 5.5EG 5.52026-07-14
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- CVE-2026-58596HIGHCVSS 8.3EG 8.32026-07-12
Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-61360MEDIUMCVSS 5.5EG 5.52026-08-11
Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally.
- CVE-2026-62737HIGHCVSS 7.8EG 7.82026-08-11
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2026-62798MEDIUMCVSS 5.5EG 5.52026-08-11
Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally.
- CVE-2026-64910HIGHCVSS 7.8EG 7.82026-08-11
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-68810HIGHCVSS 7.8EG 7.82026-08-11
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2026-7406HIGHCVSS 7.8EG 7.82026-08-06
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the curre…
- CVE-2026-8835HIGHCVSS 7.3EG 7.32026-05-26
IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.
- CVE-2026-8917HIGHCVSS 8.4EG 8.42026-08-11
Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. R…
- CVE-2026-9771HIGHCVSS 8.8EG 8.82026-08-17
The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated on…
Map vulnerabilities like CWE-822 to your infrastructure
EchelonGraph correlates every CVE — across CWE-822 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →