CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6629 vulnerabilities reference this CWE, most recent first.
GHSA-3P57-RQ4Q-233X
Vulnerability from github – Published: 2025-05-19 15:30 – Updated: 2025-07-29 21:30A flaw was found in the gnome-remote-desktop used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
{
"affected": [],
"aliases": [
"CVE-2025-4478"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-16T15:15:48Z",
"severity": "HIGH"
},
"details": "A flaw was found in the gnome-remote-desktop used by Anaconda\u0027s remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.",
"id": "GHSA-3p57-rq4q-233x",
"modified": "2025-07-29T21:30:35Z",
"published": "2025-05-19T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4478"
},
{
"type": "WEB",
"url": "https://github.com/FreeRDP/FreeRDP/pull/11573"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:9307"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-4478"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365232"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3P6J-M43H-3G48
Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2022-09-08 00:00In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.
{
"affected": [],
"aliases": [
"CVE-2020-35525"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-01T18:15:00Z",
"severity": "HIGH"
},
"details": "In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.",
"id": "GHSA-3p6j-m43h-3g48",
"modified": "2022-09-08T00:00:31Z",
"published": "2022-09-02T00:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35525"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230706-0007"
},
{
"type": "WEB",
"url": "https://www.sqlite.org/src/info/a67cf5b7d37d5b14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3P6P-HF89-XH98
Vulnerability from github – Published: 2026-07-24 18:31 – Updated: 2026-08-12 18:31In the Linux kernel, the following vulnerability has been resolved:
kernel/fork: clear PF_BLOCK_TS in copy_process()
PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL.
Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded.
{
"affected": [],
"aliases": [
"CVE-2026-64253"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T16:16:55Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/fork: clear PF_BLOCK_TS in copy_process()\n\nPF_BLOCK_TS is only set in blk_time_get_ns() when current-\u003eplug is\nnon-NULL, and blk_finish_plug() clears it via __blk_flush_plug()\nbefore NULLing the plug pointer. copy_process() breaks the\ninvariant by inheriting PF_BLOCK_TS from the parent while resetting\nthe child\u0027s plug to NULL.\n\nClear PF_BLOCK_TS alongside that assignment so callers can rely on\n\"PF_BLOCK_TS set implies current-\u003eplug != NULL\" and dereference\ncurrent-\u003eplug unguarded.",
"id": "GHSA-3p6p-hf89-xh98",
"modified": "2026-08-12T18:31:03Z",
"published": "2026-07-24T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64253"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PFQ-8M56-48P7
Vulnerability from github – Published: 2022-05-14 01:52 – Updated: 2022-05-14 01:52There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.
{
"affected": [],
"aliases": [
"CVE-2018-18829"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-30T06:29:00Z",
"severity": "MODERATE"
},
"details": "There exists a NULL pointer dereference in ff_vc1_parse_frame_header_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.",
"id": "GHSA-3pfq-8m56-48p7",
"modified": "2022-05-14T01:52:47Z",
"published": "2022-05-14T01:52:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18829"
},
{
"type": "WEB",
"url": "https://bugzilla.libav.org/show_bug.cgi?id=1136"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PH9-C37G-WMX3
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS).
{
"affected": [],
"aliases": [
"CVE-2020-19722"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T22:15:00Z",
"severity": "MODERATE"
},
"details": "An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS).",
"id": "GHSA-3ph9-c37g-wmx3",
"modified": "2022-05-24T19:08:05Z",
"published": "2022-05-24T19:08:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19722"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/418"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3PJH-4P3M-3GFM
Vulnerability from github – Published: 2024-04-08 03:30 – Updated: 2024-11-09 00:30In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed
{
"affected": [],
"aliases": [
"CVE-2023-52344"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T03:15:08Z",
"severity": "MODERATE"
},
"details": "In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed",
"id": "GHSA-3pjh-4p3m-3gfm",
"modified": "2024-11-09T00:30:41Z",
"published": "2024-04-08T03:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52344"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3PPG-6J84-F79C
Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-12-03 15:30In the Linux kernel, the following vulnerability has been resolved:
media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
{
"affected": [],
"aliases": [
"CVE-2023-53220"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T15:15:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: az6007: Fix null-ptr-deref in az6007_i2c_xfer()\n\nIn az6007_i2c_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach az6007_i2c_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",
"id": "GHSA-3ppg-6j84-f79c",
"modified": "2025-12-03T15:30:27Z",
"published": "2025-09-15T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53220"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1047f9343011f2cedc73c64829686206a7e9fc3f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5b1ea100ad3695025969dc4693f307877fb688d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6ab7ea4e17d6a605d05308adf8f3408924770cba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/991c77fe18c6f374bbf83376f8c42550aa565662"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a9def3e9718a4dc756f48db147d42ec41a966240"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/adcb73f8ce9aec48b1f85223f401c1574015d8d2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PVM-RCW8-28WJ
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).
{
"affected": [],
"aliases": [
"CVE-2020-19720"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T22:15:00Z",
"severity": "MODERATE"
},
"details": "An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS).",
"id": "GHSA-3pvm-rcw8-28wj",
"modified": "2022-05-24T19:08:05Z",
"published": "2022-05-24T19:08:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19720"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/413"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3PX4-CC65-VWJJ
Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2026-05-12 15:31In the Linux kernel, the following vulnerability has been resolved:
media: venus: protect against spurious interrupts during probe
Make sure the interrupt handler is initialized before the interrupt is registered.
If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference.
This error condition has been observed during system boot on Rb3Gen2.
{
"affected": [],
"aliases": [
"CVE-2025-39709"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-05T18:15:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: protect against spurious interrupts during probe\n\nMake sure the interrupt handler is initialized before the interrupt is\nregistered.\n\nIf the IRQ is registered before hfi_create(), it\u0027s possible that an\ninterrupt fires before the handler setup is complete, leading to a NULL\ndereference.\n\nThis error condition has been observed during system boot on Rb3Gen2.",
"id": "GHSA-3px4-cc65-vwjj",
"modified": "2026-05-12T15:31:04Z",
"published": "2025-09-05T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39709"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18c2b2bd982b8546312c9a7895515672169f28e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3200144a2fa4209dc084a19941b9b203b43580f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/37cc0ac889b018097c217c5929fd6dc2aed636a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/639eb587f977c02423f4762467055b23902b4131"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88cf63c2599761c48dec8f618d57dccf8f6f4b53"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9db6a78bc5e418e0064e2248c8f3b9b9e8418646"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e796028b4835af00d9a38ebbb208ec3a6634702a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f54be97bc69b1096198b6717c150dec69f2a1b4d"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3PX9-R72J-9HXJ
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-01-08 18:30In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg().
{
"affected": [],
"aliases": [
"CVE-2024-56535"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T14:15:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()\n\nkmalloc may fail, return value might be NULL and will cause\nNULL pointer dereference. Add check NULL return of kmalloc in\nbtc_fw_set_monreg().",
"id": "GHSA-3px9-r72j-9hxj",
"modified": "2025-01-08T18:30:47Z",
"published": "2024-12-27T15:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56535"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/051577414271961f3f4c3bff87b427924b486219"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64db1a42d98307001a48cec1b3e68ce9f905e73d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81df5ed446b448bdc327b7c7f0b50121fc1f4aa2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.