CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6663 vulnerabilities reference this CWE, most recent first.
GHSA-7X34-477R-7V7V
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2022-05-13 01:24net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.
{
"affected": [],
"aliases": [
"CVE-2011-1076"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-10-05T02:56:00Z",
"severity": "MODERATE"
},
"details": "net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.",
"id": "GHSA-7x34-477r-7v7v",
"modified": "2022-05-13T01:24:43Z",
"published": "2022-05-13T01:24:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1076"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1362fa078dae16776cd439791c6605b224ea6171"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1362fa078dae16776cd439791c6605b224ea6171"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/03/04/13"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1025162"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7X38-G79M-42JF
Vulnerability from github – Published: 2022-05-17 02:37 – Updated: 2022-05-17 02:37The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file.
{
"affected": [],
"aliases": [
"CVE-2016-7905"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-23T05:59:00Z",
"severity": "MODERATE"
},
"details": "The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file.",
"id": "GHSA-7x38-g79m-42jf",
"modified": "2022-05-17T02:37:04Z",
"published": "2022-05-17T02:37:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7905"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-71"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/10/08/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94837"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X44-CVRW-474F
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-12 21:31In the Linux kernel, the following vulnerability has been resolved:
clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else there is going to be out of bounds write when pointers 4..7 are set into struct rs9_driver_data .clk_dif[4..7] field.
Since there are other structure members past this struct clk_hw pointer array, writing to .clk_dif[4..7] fields corrupts both the struct rs9_driver_data content and data around it, sometimes without crashing the kernel. However, the kernel does surely crash when the driver is unbound or during suspend.
Fix this, increase the struct clk_hw pointer array size to the maximum output count of 9FGV0841, which is the biggest chip that is supported by this driver.
{
"affected": [],
"aliases": [
"CVE-2026-43175"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:35Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841\n\nThe 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure\nthere are 8 slots for those newly registered clk_hw pointers, else\nthere is going to be out of bounds write when pointers 4..7 are set\ninto struct rs9_driver_data .clk_dif[4..7] field.\n\nSince there are other structure members past this struct clk_hw\npointer array, writing to .clk_dif[4..7] fields corrupts both\nthe struct rs9_driver_data content and data around it, sometimes\nwithout crashing the kernel. However, the kernel does surely\ncrash when the driver is unbound or during suspend.\n\nFix this, increase the struct clk_hw pointer array size to the\nmaximum output count of 9FGV0841, which is the biggest chip that\nis supported by this driver.",
"id": "GHSA-7x44-cvrw-474f",
"modified": "2026-05-12T21:31:26Z",
"published": "2026-05-06T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43175"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f926875dffe2226ea26d129e16d9092cccd03aa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5ec820fc28d0b8a0f3890d476b1976f20e8343cc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82a34f344999d8029bcebf131028fa519140c7cc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da86ca15d7389ee0b5df08e8f70c39354e6b8a4b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X4X-J7VX-3P29
Vulnerability from github – Published: 2024-03-26 15:30 – Updated: 2024-08-06 15:30In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.
{
"affected": [],
"aliases": [
"CVE-2024-23722"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T15:15:49Z",
"severity": "HIGH"
},
"details": "In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.",
"id": "GHSA-7x4x-j7vx-3p29",
"modified": "2024-08-06T15:30:47Z",
"published": "2024-03-26T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23722"
},
{
"type": "WEB",
"url": "https://github.com/fluent/fluent-bit/compare/v2.2.1...v2.2.2"
},
{
"type": "WEB",
"url": "https://medium.com/%40adurands82/fluent-bit-dos-vulnerability-cve-2024-23722-4e3e74af9d00"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X54-3J5F-JCR9
Vulnerability from github – Published: 2022-05-17 03:06 – Updated: 2022-05-17 03:06The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
{
"affected": [],
"aliases": [
"CVE-2014-2497"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-21T14:55:00Z",
"severity": "MODERATE"
},
"details": "The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.",
"id": "GHSA-7x54-3j5f-jcr9",
"modified": "2022-05-17T03:06:12Z",
"published": "2022-05-17T03:06:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2497"
},
{
"type": "WEB",
"url": "https://bugs.php.net/bug.php?id=66901"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076676"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201607-04"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT204659"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0288.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1326.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1327.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1766.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59061"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59418"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59496"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59652"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3215"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:153"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/66233"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2987-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7X54-V488-56PJ
Vulnerability from github – Published: 2024-07-29 15:30 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
mm: prevent derefencing NULL ptr in pfn_section_valid()
Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it.
{
"affected": [],
"aliases": [
"CVE-2024-41055"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T15:15:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: prevent derefencing NULL ptr in pfn_section_valid()\n\nCommit 5ec8e8ea8b77 (\"mm/sparsemem: fix race in accessing\nmemory_section-\u003eusage\") changed pfn_section_valid() to add a READ_ONCE()\ncall around \"ms-\u003eusage\" to fix a race with section_deactivate() where\nms-\u003eusage can be cleared. The READ_ONCE() call, by itself, is not enough\nto prevent NULL pointer dereference. We need to check its value before\ndereferencing it.",
"id": "GHSA-7x54-v488-56pj",
"modified": "2025-11-04T00:31:00Z",
"published": "2024-07-29T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41055"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0100aeb8a12d51950418e685f879cc80cb8e5982"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/797323d1cf92d09b7a017cfec576d9babf99cde7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82f0b6f041fad768c28b4ad05a683065412c226e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/941e816185661bf2b44b488565d09444ae316509"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/adccdf702b4ea913ded5ff512239e382d7473b63"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bc17f2377818dca643a74499c3f5333500c90503"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X55-VPF3-JCJ3
Vulnerability from github – Published: 2022-10-14 19:00 – Updated: 2025-05-14 21:31The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
{
"affected": [],
"aliases": [
"CVE-2022-41594"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-14T16:15:00Z",
"severity": "LOW"
},
"details": "The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.",
"id": "GHSA-7x55-vpf3-jcj3",
"modified": "2025-05-14T21:31:10Z",
"published": "2022-10-14T19:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41594"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2022/10"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7X5P-5275-MMVG
Vulnerability from github – Published: 2025-01-11 18:30 – Updated: 2025-01-16 15:32In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases, such as when freeing the highest pageblock in the last memory section, this could result with CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and __section_mem_map_addr() dereferencing that NULL pointer.
Let's fix it, and avoid doing a pfn_to_page() call for the first iteration, where we already have the page.
So far this was found by code inspection, but let's just CC stable as the fix is easy.
{
"affected": [],
"aliases": [
"CVE-2024-57881"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-11T16:15:24Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: don\u0027t call pfn_to_page() on possibly non-existent PFN in split_large_buddy()\n\nIn split_large_buddy(), we might call pfn_to_page() on a PFN that might\nnot exist. In corner cases, such as when freeing the highest pageblock in\nthe last memory section, this could result with CONFIG_SPARSEMEM \u0026\u0026\n!CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and\n__section_mem_map_addr() dereferencing that NULL pointer.\n\nLet\u0027s fix it, and avoid doing a pfn_to_page() call for the first\niteration, where we already have the page.\n\nSo far this was found by code inspection, but let\u0027s just CC stable as the\nfix is easy.",
"id": "GHSA-7x5p-5275-mmvg",
"modified": "2025-01-16T15:32:09Z",
"published": "2025-01-11T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57881"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4234ca9884bcae9e48ed38652d91696ad5cd591d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/faeec8e23c10bd30e8aa759a2eb3018dae00f924"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X6G-6G4C-Q7PF
Vulnerability from github – Published: 2022-03-17 00:00 – Updated: 2022-03-17 00:00Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2021-40778"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-16T15:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe Media Encoder 15.4.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-7x6g-6g4c-q7pf",
"modified": "2022-03-17T00:00:32Z",
"published": "2022-03-17T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40778"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/media-encoder/apsb21-99.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X88-9HGC-69GF
Vulnerability from github – Published: 2026-04-08 00:30 – Updated: 2026-05-12 15:31Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.
Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.
When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.
Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.
The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
{
"affected": [],
"aliases": [
"CVE-2026-28389"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-07T22:16:21Z",
"severity": "HIGH"
},
"details": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"id": "GHSA-7x88-9hgc-69gf",
"modified": "2026-05-12T15:31:15Z",
"published": "2026-04-08T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28389"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a"
},
{
"type": "WEB",
"url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"type": "WEB",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.