CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6702 vulnerabilities reference this CWE, most recent first.
GHSA-G4Q8-M3PW-QHVV
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-16 03:30In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix NULL pointer dereference in __unix_needs_revalidation
When receiving file descriptors via SCM_RIGHTS, both the socket pointer and the socket's sk pointer can be NULL during socket setup or teardown, causing NULL pointer dereferences in __unix_needs_revalidation().
This is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new __unix_needs_revalidation() function was added without proper NULL checks.
The crash manifests as: BUG: kernel NULL pointer dereference, address: 0x0000000000000018 RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0) Call Trace: apparmor_file_receive+0x42/0x80 security_file_receive+0x2e/0x50 receive_fd+0x1d/0xf0 scm_detach_fds+0xad/0x1c0
The function dereferences sock->sk->sk_family without checking if either sock or sock->sk is NULL first.
Add NULL checks for both sock and sock->sk before accessing sk_family.
{
"affected": [],
"aliases": [
"CVE-2026-45966"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:13Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix NULL pointer dereference in __unix_needs_revalidation\n\nWhen receiving file descriptors via SCM_RIGHTS, both the socket pointer\nand the socket\u0027s sk pointer can be NULL during socket setup or teardown,\ncausing NULL pointer dereferences in __unix_needs_revalidation().\n\nThis is a regression in AppArmor 5.0.0 (kernel 6.17+) where the new\n__unix_needs_revalidation() function was added without proper NULL checks.\n\nThe crash manifests as:\n BUG: kernel NULL pointer dereference, address: 0x0000000000000018\n RIP: aa_file_perm+0xb7/0x3b0 (or +0xbe/0x3b0, +0xc0/0x3e0)\n Call Trace:\n apparmor_file_receive+0x42/0x80\n security_file_receive+0x2e/0x50\n receive_fd+0x1d/0xf0\n scm_detach_fds+0xad/0x1c0\n\nThe function dereferences sock-\u003esk-\u003esk_family without checking if either\nsock or sock-\u003esk is NULL first.\n\nAdd NULL checks for both sock and sock-\u003esk before accessing sk_family.",
"id": "GHSA-g4q8-m3pw-qhvv",
"modified": "2026-06-16T03:30:33Z",
"published": "2026-05-27T15:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45966"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e2938ad00b21340c0362562dfedd7cfec0554d67"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e85bc9101afc4202aa2269967ce9d3ffbecd0994"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fea017a7f6abe179decf575a2d8464c74edb3964"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4QH-PGMQ-G946
Vulnerability from github – Published: 2023-12-25 09:30 – Updated: 2023-12-29 21:30C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.
{
"affected": [],
"aliases": [
"CVE-2023-37187"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-25T07:15:09Z",
"severity": "HIGH"
},
"details": "C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.",
"id": "GHSA-g4qh-pgmq-g946",
"modified": "2023-12-29T21:30:46Z",
"published": "2023-12-25T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37187"
},
{
"type": "WEB",
"url": "https://github.com/Blosc/c-blosc2/issues/520"
},
{
"type": "WEB",
"url": "https://github.com/Blosc/c-blosc2/commit/425e8a9a59d49378d57e2116b6c9b0190a5986f5"
},
{
"type": "WEB",
"url": "https://github.com/Blosc/c-blosc2/compare/v2.9.2...v2.9.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4QQ-W8W3-624Q
Vulnerability from github – Published: 2022-05-17 02:54 – Updated: 2022-05-17 02:54The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.
{
"affected": [],
"aliases": [
"CVE-2017-5937"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-15T19:59:00Z",
"severity": "MODERATE"
},
"details": "The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a denial of service (NULL pointer dereference) via a crafted VIRGL_CCMD_CLEAR command.",
"id": "GHSA-g4qq-w8w3-624q",
"modified": "2022-05-17T02:54:58Z",
"published": "2022-05-17T02:54:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5937"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1420246"
},
{
"type": "WEB",
"url": "https://cgit.freedesktop.org/virglrenderer/commit/?id=48f67f60967f963b698ec8df57ec6912a43d6282"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/09/4"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96180"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4VX-757M-G7RM
Vulnerability from github – Published: 2022-12-14 21:30 – Updated: 2022-12-17 00:30An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.
{
"affected": [],
"aliases": [
"CVE-2022-3110"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-14T21:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.",
"id": "GHSA-g4vx-757m-g7rm",
"modified": "2022-12-17T00:30:21Z",
"published": "2022-12-14T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3110"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153055"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2\u0026id=f94b47c6bde624d6c07f43054087607c52054a95"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4W6-JW6R-6882
Vulnerability from github – Published: 2025-03-06 18:31 – Updated: 2025-03-25 15:31In the Linux kernel, the following vulnerability has been resolved:
clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check
The devm_kzalloc() function returns NULL on error, not error pointers. Fix the check.
{
"affected": [],
"aliases": [
"CVE-2024-58065"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-06T16:15:52Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check\n\nThe devm_kzalloc() function returns NULL on error, not error pointers.\nFix the check.",
"id": "GHSA-g4w6-jw6r-6882",
"modified": "2025-03-25T15:31:22Z",
"published": "2025-03-06T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58065"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6628f7f88de5f65f01adef5a63c707cb49d0fddb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e5ca5d7b4d7c29246d957dc45d63610584ae3a54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G4X3-C7QW-7JMF
Vulnerability from github – Published: 2025-09-26 15:30 – Updated: 2025-09-26 15:30A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.
{
"affected": [],
"aliases": [
"CVE-2025-11013"
],
"database_specific": {
"cwe_ids": [
"CWE-404",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T13:15:40Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xml_parsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit is publicly available and might be used.",
"id": "GHSA-g4x3-c7qw-7jmf",
"modified": "2025-09-26T15:30:28Z",
"published": "2025-09-26T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11013"
},
{
"type": "WEB",
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1003"
},
{
"type": "WEB",
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1004"
},
{
"type": "WEB",
"url": "https://github.com/user-attachments/files/22245915/poc.zip"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.325956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.325956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.654075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G4X4-MR34-3PW3
Vulnerability from github – Published: 2026-02-25 15:31 – Updated: 2026-02-25 15:31NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service
{
"affected": [],
"aliases": [
"CVE-2026-3202"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-25T15:20:55Z",
"severity": "MODERATE"
},
"details": "NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service",
"id": "GHSA-g4x4-mr34-3pw3",
"modified": "2026-02-25T15:31:43Z",
"published": "2026-02-25T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3202"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/21000"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-06.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G57F-G3M7-5229
Vulnerability from github – Published: 2025-07-07 03:30 – Updated: 2025-07-07 03:30Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.
{
"affected": [],
"aliases": [
"CVE-2025-53184"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-07T03:15:29Z",
"severity": "MODERATE"
},
"details": "Null pointer dereference vulnerability in the PDF preview module\nImpact: Successful exploitation of this vulnerability may affect function stability.",
"id": "GHSA-g57f-g3m7-5229",
"modified": "2025-07-07T03:30:23Z",
"published": "2025-07-07T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53184"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2025/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G58V-GQQ5-MHVJ
Vulnerability from github – Published: 2022-05-17 02:58 – Updated: 2025-04-20 03:32The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.
{
"affected": [],
"aliases": [
"CVE-2016-8676"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-15T21:59:00Z",
"severity": "MODERATE"
},
"details": "The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.",
"id": "GHSA-g58v-gqq5-mhvj",
"modified": "2025-04-20T03:32:57Z",
"published": "2022-05-17T02:58:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8676"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2016/09/07/libav-null-pointer-dereference-in-get_vlc2_get_bits_h"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2016/12/01/libav-multiple-crashes-from-the-undefined-behavior-sanitizer"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/10/16/13"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/12/04/3"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93468"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G5MH-VXPW-8CVF
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 15:31In the Linux kernel, the following vulnerability has been resolved:
media: mtk-mdp: Fix error handling in probe function
Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent resource leak.
Add check for the return value of vpu_get_plat_device() to prevent null pointer dereference. And vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put() to prevent reference leak.
{
"affected": [],
"aliases": [
"CVE-2026-43207"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T12:16:40Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-mdp: Fix error handling in probe function\n\nAdd mtk_mdp_unregister_m2m_device() on the error handling path to prevent\nresource leak.\n\nAdd check for the return value of vpu_get_plat_device() to prevent null\npointer dereference. And vpu_get_plat_device() increases the reference\ncount of the returned platform device. Add platform_device_put() to\nprevent reference leak.",
"id": "GHSA-g5mh-vxpw-8cvf",
"modified": "2026-05-08T15:31:17Z",
"published": "2026-05-06T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43207"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0bc43eaf021347f8d5aba87712c36b799695eec6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/12cafc15d24611bfb43c82877b1bbb7454a85d5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2e8f53a7382943411557e370f1a4f3946624a30e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8a8a3232abac5b972058a5f2cb3e33199d2a8648"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d9c67976eda502edc6b3a148a1c5b6a18b69a98"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3fc99fe5b25613dd61c57bc70b8479adff4f60d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c8737d33d4e8ffae87e5d5edac17f8a705235cc2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.