CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6959 vulnerabilities reference this CWE, most recent first.
GHSA-W7FH-6798-HQC2
Vulnerability from github – Published: 2022-05-14 01:12 – Updated: 2022-05-14 01:12w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.
{
"affected": [],
"aliases": [
"CVE-2018-6197"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-25T03:29:00Z",
"severity": "HIGH"
},
"details": "w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.",
"id": "GHSA-w7fh-6798-hqc2",
"modified": "2022-05-14T01:12:47Z",
"published": "2022-05-14T01:12:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6197"
},
{
"type": "WEB",
"url": "https://github.com/tats/w3m/issues/89"
},
{
"type": "WEB",
"url": "https://github.com/tats/w3m/commit/7fdc83b0364005a0b5ed869230dd81752ba022e8"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00025.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3555-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3555-2"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00028.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102846"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W7MJ-V6M2-38QQ
Vulnerability from github – Published: 2026-10-14 18:32 – Updated: 2026-10-14 18:32A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.
{
"affected": [],
"aliases": [
"CVE-2026-102021"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T17:17:55Z",
"severity": "HIGH"
},
"details": "A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent network attacker to cause a denial of service via a crafted RSVP packet when MPLS-TE RSVP processing is enabled. The condition can terminate rpd and disrupt routing protocol sessions.",
"id": "GHSA-w7mj-v6m2-38qq",
"modified": "2026-10-14T18:32:23Z",
"published": "2026-10-14T18:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102021"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA112187"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W7P5-2W2W-6HJM
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-08-13 15:34In the Linux kernel, the following vulnerability has been resolved:
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat.
This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following:
[53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e
So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter().
{
"affected": [],
"aliases": [
"CVE-2026-64164"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:58Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()\n\nThe trace event btrfs_sync_file() is called in an atomic context (all trace\nevents are) and its call to dput(), which is needed due to the call to\ndget_parent(), can sleep, triggering a kernel splat.\n\nThis can be reproduced by enabling the trace event and running btrfs/056\nfrom fstests for example. The splat shown in dmesg is the following:\n\n [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970\n [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io\n [53.988] preempt_count: 2, expected: 0\n [53.967] RCU nest depth: 0, expected: 0\n [53.943] Preemption disabled at:\n [53.944] [\u003c0000000000000000\u003e] 0x0\n [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full)\n [54.070] Tainted: [W]=WARN\n [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n [54.072] Call Trace:\n [54.074] \u003cTASK\u003e\n [54.076] dump_stack_lvl+0x56/0x80\n [54.079] __might_resched.cold+0xd6/0x10f\n [54.072] dput.part.0+0x24/0x110\n [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs]\n [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs]\n [54.087] ? __handle_mm_fault+0x8ae/0xed0\n [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs]\n [54.091] vfs_write+0x21f/0x450\n [54.094] __x64_sys_pwrite64+0x8d/0xc0\n [54.096] ? do_user_addr_fault+0x20c/0x670\n [54.099] do_syscall_64+0x60/0xf20\n [54.092] ? clear_bhb_loop+0x60/0xb0\n [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nSo stop using dget_parent() and dput() and access the parent dentry\ndirectly as dentry-\u003ed_parent. This is also what ext4 is doing in\nits equivalent trace event ext4_sync_file_enter().",
"id": "GHSA-w7p5-2w2w-6hjm",
"modified": "2026-08-13T15:34:15Z",
"published": "2026-07-19T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64164"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W7PH-W892-Q2WC
Vulnerability from github – Published: 2025-10-15 15:30 – Updated: 2025-10-15 15:30A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated user to cause a Windows blue screen error.
{
"affected": [],
"aliases": [
"CVE-2025-9548"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-15T15:16:07Z",
"severity": "MODERATE"
},
"details": "A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated user to cause a Windows blue screen error.",
"id": "GHSA-w7ph-w892-q2wc",
"modified": "2025-10-15T15:30:29Z",
"published": "2025-10-15T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9548"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-203293"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W7RP-6Q39-G7QW
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.
{
"affected": [],
"aliases": [
"CVE-2018-7731"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-06T18:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.",
"id": "GHSA-w7rp-6q39-g7qw",
"modified": "2022-05-13T01:14:05Z",
"published": "2022-05-13T01:14:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7731"
},
{
"type": "WEB",
"url": "https://bugs.freedesktop.org/show_bug.cgi?id=105247"
},
{
"type": "WEB",
"url": "https://cgit.freedesktop.org/exempi/commit/?id=aabedb5e749dd59112a3fe1e8e08f2d934f56666"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCFXKOOATZ2B5G3G7EBXZWVZHEABN4ZV"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3668-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W7W2-8HR6-7GCF
Vulnerability from github – Published: 2026-10-13 15:32 – Updated: 2026-10-13 15:32FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.
{
"affected": [],
"aliases": [
"CVE-2026-109679"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T14:17:31Z",
"severity": "MODERATE"
},
"details": "FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.",
"id": "GHSA-w7w2-8hr6-7gcf",
"modified": "2026-10-13T15:32:22Z",
"published": "2026-10-13T15:32:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qjwp-c855-hc69"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109679"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-beta4-before-3.32.0-null-pointer-crash-via-arm-response"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W7W4-RX65-9VWW
Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-12130"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-20T00:29:00Z",
"severity": "HIGH"
},
"details": "An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerability.",
"id": "GHSA-w7w4-rx65-9vww",
"modified": "2022-05-13T01:01:36Z",
"published": "2022-05-13T01:01:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12130"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0486"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102795"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W85Q-R4HM-228C
Vulnerability from github – Published: 2022-08-05 00:00 – Updated: 2022-08-11 00:00In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2022-34651"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-04T18:15:00Z",
"severity": "HIGH"
},
"details": "In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-w85q-r4hm-228c",
"modified": "2022-08-11T00:00:19Z",
"published": "2022-08-05T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34651"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K59197053"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W863-C2HV-XJC5
Vulnerability from github – Published: 2024-12-17 15:31 – Updated: 2024-12-17 18:33A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2024-37605"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-17T15:15:13Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.",
"id": "GHSA-w863-c2hv-xjc5",
"modified": "2024-12-17T18:33:48Z",
"published": "2024-12-17T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37605"
},
{
"type": "WEB",
"url": "https://docs.google.com/document/d/1cWlVLaVvr_xzkqbKIXY7EW89hNHE89SSlNtesv6lzl8/edit?usp=sharing"
},
{
"type": "WEB",
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397"
},
{
"type": "WEB",
"url": "https://www.dlink.com/en"
},
{
"type": "WEB",
"url": "https://www.dlink.com/en/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W88V-7X97-PGV3
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2024-03-21 03:33An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
{
"affected": [],
"aliases": [
"CVE-2019-12378"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-28T03:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).",
"id": "GHSA-w88v-7x97-pgv3",
"modified": "2024-03-21T03:33:40Z",
"published": "2022-05-24T16:46:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12378"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=95baa60a0da80a0143e3ddd4d3725758b4513825"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLGWJKLMTBBB53D5QLS4HOY2EH246WBE"
},
{
"type": "WEB",
"url": "https://lkml.org/lkml/2019/5/25/229"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108475"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.