CWE-476

{
  "affected": [],
  "aliases": [
    "CVE-2025-70954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-13T22:16:10Z",
    "severity": "HIGH"
  },
  "details": "A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network.",
  "id": "GHSA-g989-fg9h-96pr",
  "modified": "2026-02-17T21:31:13Z",
  "published": "2026-02-14T00:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70954"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233"
    },
    {
      "type": "WEB",
      "url": "https://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg"
    },
    {
      "type": "WEB",
      "url": "https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-17T22:15:11Z",
    "severity": "MODERATE"
  },
  "details": "A NULL pointer dereference flaw was found in Libtiff\u0027s LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.",
  "id": "GHSA-g995-h8wx-7qw6",
  "modified": "2024-04-04T04:14:02Z",
  "published": "2023-05-18T00:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libsdl-org/libtiff/commit/9be22b639ea69e102d3847dca4c53ef025e9527b"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-2731"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2207635"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/libtiff/libtiff/-/issues/548"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230703-0009"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T10:16:39Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: saa7164: add ioremap return checks and cleanups\n\nAdd checks for ioremap return values in saa7164_dev_setup(). If\nioremap for BAR0 or BAR2 fails, release the already allocated PCI\nmemory regions, remove the device from the global list, decrement\nthe device count, and return -ENODEV.\n\nThis prevents potential null pointer dereferences and ensures proper\ncleanup on memory mapping failures.",
  "id": "GHSA-g99c-g7mv-2xpg",
  "modified": "2026-06-10T21:31:26Z",
  "published": "2026-05-28T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46235"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/23dee5990d2c27ed79567fd61ccfe6876768531a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ce8f3057c51bb0a66aa3fab0862be74e9f88684"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6047dc542fa404b5c187cc2c7906aaaaec6d11ed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c22a6d8e4c1507bba504aeebe80476144a373eb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9b83f46e52cf1239d780920d1a7a3e415f7b5d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d51c60a498e83c9a79884c8e420f97e3885c9583"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-30665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-14T18:15:30Z",
    "severity": "MODERATE"
  },
  "details": "NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.",
  "id": "GHSA-g9fx-4qg5-6rm4",
  "modified": "2025-05-14T18:30:51Z",
  "published": "2025-05-14T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30665"
    },
    {
      "type": "WEB",
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25018"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T15:15:20Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/powernv: Add a null pointer check in opal_powercap_init()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.",
  "id": "GHSA-g9gx-3ccx-85w8",
  "modified": "2024-07-03T18:42:25Z",
  "published": "2024-05-17T15:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52696"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/69f95c5e9220f77ce7c540686b056c2b49e9a664"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b58d16037217d0c64a2a09b655f370403ec7219"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9da4a56dd3772570512ca58aa8832b052ae910dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a67a04ad05acb56640798625e73fa54d6d41cce1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b02ecc35d01a76b4235e008d2dd292895b28ecab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e123015c0ba859cf48aa7f89c5016cc6e98e018d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f152a6bfd187f67afeffc9fd68cbe46f51439be0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-23250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-18T18:16:22Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: check return value of xchk_scrub_create_subord\n\nFix this function to return NULL instead of a mangled ENOMEM, then fix\nthe callers to actually check for a null pointer and return ENOMEM.\nMost of the corrections here are for code merged between 6.2 and 6.10.",
  "id": "GHSA-g9h3-f67f-jqj7",
  "modified": "2026-05-21T21:30:28Z",
  "published": "2026-03-18T18:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23250"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b658d1249666cc55af9484dcf5f45ca438d4ecc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b2df809edd8cb7d1c3e19d9f6aabc2bd55d2bfb6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ca27313fb3f23e4ac18532ede4ec1c7cc5814c4a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d6f3f7d4dd8a179394cef03c00993d57f5f68601"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-12845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-27T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.",
  "id": "GHSA-g9j5-2x3f-77xp",
  "modified": "2022-11-29T03:30:25Z",
  "published": "2022-05-24T17:24:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12845"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cherokee/webserver/issues/1242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cherokee/webserver/releases"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202012-09"
    },
    {
      "type": "WEB",
      "url": "http://cherokee-project.com/downloads.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T18:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in the\n`dcn20_program_pipe` function. The issue could occur when\n`pipe_ctx-\u003eplane_state` is null.\n\nThe fix adds a check to ensure `pipe_ctx-\u003eplane_state` is not null\nbefore accessing. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed \u0027pipe_ctx-\u003eplane_state\u0027 could be null (see line 1877)",
  "id": "GHSA-g9mh-3crx-2qvf",
  "modified": "2024-12-09T15:31:33Z",
  "published": "2024-10-21T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49914"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/65a6fee22d5cfa645cb05489892dc9cd3d142fc2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68f75e6f08aad66069a629db8d7840919156c761"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-27277"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-11T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execute arbitrary code.",
  "id": "GHSA-g9mq-5vvv-88hf",
  "modified": "2022-05-24T17:38:34Z",
  "published": "2022-05-24T17:38:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27277"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-005-05"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-033"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-37774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-01T14:15:40Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nslab: ensure slab-\u003eobj_exts is clear in a newly allocated slab page\n\nktest recently reported crashes while running several buffered io tests\nwith __alloc_tagging_slab_alloc_hook() at the top of the crash call stack.\nThe signature indicates an invalid address dereference with low bits of\nslab-\u003eobj_exts being set. The bits were outside of the range used by\npage_memcg_data_flags and objext_flags and hence were not masked out\nby slab_obj_exts() when obtaining the pointer stored in slab-\u003eobj_exts.\nThe typical crash log looks like this:\n\n00510 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n00510 Mem abort info:\n00510   ESR = 0x0000000096000045\n00510   EC = 0x25: DABT (current EL), IL = 32 bits\n00510   SET = 0, FnV = 0\n00510   EA = 0, S1PTW = 0\n00510   FSC = 0x05: level 1 translation fault\n00510 Data abort info:\n00510   ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000\n00510   CM = 0, WnR = 1, TnD = 0, TagAccess = 0\n00510   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n00510 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000104175000\n00510 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n00510 Internal error: Oops: 0000000096000045 [#1]  SMP\n00510 Modules linked in:\n00510 CPU: 10 UID: 0 PID: 7692 Comm: cat Not tainted 6.15.0-rc1-ktest-g189e17946605 #19327 NONE\n00510 Hardware name: linux,dummy-virt (DT)\n00510 pstate: 20001005 (nzCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)\n00510 pc : __alloc_tagging_slab_alloc_hook+0xe0/0x190\n00510 lr : __kmalloc_noprof+0x150/0x310\n00510 sp : ffffff80c87df6c0\n00510 x29: ffffff80c87df6c0 x28: 000000000013d1ff x27: 000000000013d200\n00510 x26: ffffff80c87df9e0 x25: 0000000000000000 x24: 0000000000000001\n00510 x23: ffffffc08041953c x22: 000000000000004c x21: ffffff80c0002180\n00510 x20: fffffffec3120840 x19: ffffff80c4821000 x18: 0000000000000000\n00510 x17: fffffffec3d02f00 x16: fffffffec3d02e00 x15: fffffffec3d00700\n00510 x14: fffffffec3d00600 x13: 0000000000000200 x12: 0000000000000006\n00510 x11: ffffffc080bb86c0 x10: 0000000000000000 x9 : ffffffc080201e58\n00510 x8 : ffffff80c4821060 x7 : 0000000000000000 x6 : 0000000055555556\n00510 x5 : 0000000000000001 x4 : 0000000000000010 x3 : 0000000000000060\n00510 x2 : 0000000000000000 x1 : ffffffc080f50cf8 x0 : ffffff80d801d000\n00510 Call trace:\n00510  __alloc_tagging_slab_alloc_hook+0xe0/0x190 (P)\n00510  __kmalloc_noprof+0x150/0x310\n00510  __bch2_folio_create+0x5c/0xf8\n00510  bch2_folio_create+0x2c/0x40\n00510  bch2_readahead+0xc0/0x460\n00510  read_pages+0x7c/0x230\n00510  page_cache_ra_order+0x244/0x3a8\n00510  page_cache_async_ra+0x124/0x170\n00510  filemap_readahead.isra.0+0x58/0xa0\n00510  filemap_get_pages+0x454/0x7b0\n00510  filemap_read+0xdc/0x418\n00510  bch2_read_iter+0x100/0x1b0\n00510  vfs_read+0x214/0x300\n00510  ksys_read+0x6c/0x108\n00510  __arm64_sys_read+0x20/0x30\n00510  invoke_syscall.constprop.0+0x54/0xe8\n00510  do_el0_svc+0x44/0xc8\n00510  el0_svc+0x18/0x58\n00510  el0t_64_sync_handler+0x104/0x130\n00510  el0t_64_sync+0x154/0x158\n00510 Code: d5384100 f9401c01 b9401aa3 b40002e1 (f8227881)\n00510 ---[ end trace 0000000000000000 ]---\n00510 Kernel panic - not syncing: Oops: Fatal exception\n00510 SMP: stopping secondary CPUs\n00510 Kernel Offset: disabled\n00510 CPU features: 0x0000,000000e0,00000410,8240500b\n00510 Memory Limit: none\n\nInvestigation indicates that these bits are already set when we allocate\nslab page and are not zeroed out after allocation. We are not yet sure\nwhy these crashes start happening only recently but regardless of the\nreason, not initializing a field that gets used later is wrong. Fix it\nby initializing slab-\u003eobj_exts during slab page allocation.",
  "id": "GHSA-g9q4-8883-7234",
  "modified": "2025-11-07T00:30:26Z",
  "published": "2025-05-01T15:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37774"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/28bef6622a1a874fe63aceeb0c684fab75afb3ae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8baa747193591410a853bac9c3710142dfa4937b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d2f5819b6ed357c0c350c0616b6b9f38be59adf6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}