Common Weakness Enumeration
CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6372 vulnerabilities reference this CWE, most recent first.
GHSA-3353-8XH7-8F2X
Vulnerability from github – Published: 2025-06-02 03:30 – Updated: 2025-06-02 18:30
VLAI
Details
In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413201; Issue ID: MSV-3302.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-20675"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T03:15:24Z",
"severity": "MODERATE"
},
"details": "In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413201; Issue ID: MSV-3302.",
"id": "GHSA-3353-8xh7-8f2x",
"modified": "2025-06-02T18:30:42Z",
"published": "2025-06-02T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20675"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/June-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-335X-2H4V-298W
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28
VLAI
Details
The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
{
"affected": [],
"aliases": [
"CVE-2014-4344"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-08-14T05:01:00Z",
"severity": "HIGH"
},
"details": "The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.",
"id": "GHSA-335x-2h4v-298w",
"modified": "2022-05-13T01:28:50Z",
"published": "2022-05-13T01:28:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4344"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/a7886f0ed1277c69142b14a2c6629175a6331edc"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121877"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95210"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0345.html"
},
{
"type": "WEB",
"url": "http://aix.software.ibm.com/aix/efixes/security/nas_advisory1.asc"
},
{
"type": "WEB",
"url": "http://krbdev.mit.edu/rt/Ticket/Display.html?id=7970"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0439.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59102"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60082"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60448"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/61051"
},
{
"type": "WEB",
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15561.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-3000"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:165"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/109389"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69160"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1030706"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3366-GW57-FCM5
Vulnerability from github – Published: 2026-03-19 17:47 – Updated: 2026-03-25 21:33
VLAI
Summary
Ella Core panics on malformed ULNASTransport Message without a Request Type
Details
Summary
Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type.
Impact
An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required.
Fix
Add a guard when receiving an UL NAS Message without a Request Type given no SM Context.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ellanetworks/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33283"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-19T17:47:12Z",
"nvd_published_at": "2026-03-24T00:16:30Z",
"severity": "MODERATE"
},
"details": "## Summary\nElla Core panics when processing malformed UL NAS Transport NAS messages without a Request Type.\n\n## Impact\nAn attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required.\n\n## Fix\nAdd a guard when receiving an UL NAS Message without a Request Type given no SM Context.",
"id": "GHSA-3366-gw57-fcm5",
"modified": "2026-03-25T21:33:00Z",
"published": "2026-03-19T17:47:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-3366-gw57-fcm5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33283"
},
{
"type": "PACKAGE",
"url": "https://github.com/ellanetworks/core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Ella Core panics on malformed ULNASTransport Message without a Request Type"
}
GHSA-3383-3582-42X2
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14
VLAI
Details
The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
{
"affected": [],
"aliases": [
"CVE-2021-32135"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-13T15:15:00Z",
"severity": "MODERATE"
},
"details": "The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.",
"id": "GHSA-3383-3582-42x2",
"modified": "2022-05-24T19:14:20Z",
"published": "2022-05-24T19:14:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32135"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/1757"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/b8f8b202d4fc23eb0ab4ce71ae96536ca6f5d3f8"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-338P-6JC2-VVP7
Vulnerability from github – Published: 2022-05-17 02:22 – Updated: 2022-05-17 02:22
VLAI
Details
IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2016-4724"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-25T10:59:00Z",
"severity": "HIGH"
},
"details": "IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.",
"id": "GHSA-338p-6jc2-vvp7",
"modified": "2022-05-17T02:22:12Z",
"published": "2022-05-17T02:22:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4724"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207143"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207170"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93056"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036858"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-33C2-32M9-Q3CG
Vulnerability from github – Published: 2022-10-04 00:00 – Updated: 2022-10-05 00:00
VLAI
Details
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-42306"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-03T15:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.",
"id": "GHSA-33c2-32m9-q3cg",
"modified": "2022-10-05T00:00:37Z",
"published": "2022-10-04T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42306"
},
{
"type": "WEB",
"url": "https://www.veritas.com/content/support/en_US/security/VTS22-010#M1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-33C6-JW29-2569
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2022-06-11 00:00
VLAI
Details
libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-29788"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "MODERATE"
},
"details": "libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.",
"id": "GHSA-33c6-jw29-2569",
"modified": "2022-06-11T00:00:37Z",
"published": "2022-06-03T00:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29788"
},
{
"type": "WEB",
"url": "https://github.com/bfabiszewski/libmobi/commit/ce0ab6586069791b1e8e2a42f44318e581c39939"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-33CJ-4M4M-JHXC
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-20195"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-18T01:29:00Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference was discovered in ic_predict of libfaad/ic_predict.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.",
"id": "GHSA-33cj-4m4m-jhxc",
"modified": "2022-05-13T01:25:47Z",
"published": "2022-05-13T01:25:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20195"
},
{
"type": "WEB",
"url": "https://github.com/knik0/faad2/issues/25"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/28"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202006-17"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4522"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-33FH-4PVQ-9X35
Vulnerability from github – Published: 2025-03-18 18:30 – Updated: 2026-06-26 00:31
VLAI
Details
A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-2487"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T17:15:48Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.",
"id": "GHSA-33fh-4pvq-9x35",
"modified": "2026-06-26T00:31:59Z",
"published": "2025-03-18T18:30:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/389ds/389-ds-base/security/advisories/GHSA-426r-w669-66gw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2487"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3663"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3670"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4491"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7395"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-2487"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2353071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-33PC-Q72M-P74W
Vulnerability from github – Published: 2023-10-15 03:30 – Updated: 2023-10-15 03:30
VLAI
Details
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-5586"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-15T01:15:09Z",
"severity": "MODERATE"
},
"details": "NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV.",
"id": "GHSA-33pc-q72m-p74w",
"modified": "2023-10-15T03:30:30Z",
"published": "2023-10-15T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5586"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/ca1b48f0abe71bf81a58995d7d75dc27f5a17ddc"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/d2a6ea71-3555-47a6-9b18-35455d103740"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Requirements
Select a programming language that is not susceptible to these issues.
Mitigation
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.