CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6326 vulnerabilities reference this CWE, most recent first.
GHSA-2R49-C9GH-XP83
Vulnerability from github – Published: 2026-01-14 15:33 – Updated: 2026-03-25 18:31In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Add missing NULL pointer check for pingpong interface
It is checked almost always in dpu_encoder_phys_wb_setup_ctl(), but in a single place the check is missing. Also use convenient locals instead of phys_enc->* where available.
Patchwork: https://patchwork.freedesktop.org/patch/693860/
{
"affected": [],
"aliases": [
"CVE-2025-71138"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T15:16:03Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add missing NULL pointer check for pingpong interface\n\nIt is checked almost always in dpu_encoder_phys_wb_setup_ctl(), but in a\nsingle place the check is missing.\nAlso use convenient locals instead of phys_enc-\u003e* where available.\n\nPatchwork: https://patchwork.freedesktop.org/patch/693860/",
"id": "GHSA-2r49-c9gh-xp83",
"modified": "2026-03-25T18:31:34Z",
"published": "2026-01-14T15:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71138"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/35ea3282136a630a3fd92b76f5a3a02651145ef1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/471baae774a30a04cf066907b60eaf3732928cb7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/678d1c86566dfbb247ba25482d37fddde6140cc9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88733a0b64872357e5ecd82b7488121503cb9cc6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2R5H-WGV6-M4RV
Vulnerability from github – Published: 2022-05-14 01:30 – Updated: 2022-05-14 01:30An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur.
{
"affected": [],
"aliases": [
"CVE-2018-7052"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-15T20:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur.",
"id": "GHSA-2r5h-wgv6-m4rv",
"modified": "2022-05-14T01:30:15Z",
"published": "2022-05-14T01:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7052"
},
{
"type": "WEB",
"url": "https://irssi.org/security/irssi_sa_2018_02.txt"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3590-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4162"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/02/15/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2R9H-7MX9-FQ3W
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).
{
"affected": [],
"aliases": [
"CVE-2020-36148"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-08T21:15:00Z",
"severity": "MODERATE"
},
"details": "Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault error in case of restrictive memory protection or near NULL pointer overwrite in case of no memory restrictions (e.g. in embedded environments).",
"id": "GHSA-2r9h-7mx9-fq3w",
"modified": "2022-05-24T17:41:17Z",
"published": "2022-05-24T17:41:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36148"
},
{
"type": "WEB",
"url": "https://github.com/hoene/libmysofa/issues/138"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQLNZOVVONQSZZJHQVZT6NMOUUDMGBBR"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2RCM-MM94-FJ4V
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.
{
"affected": [],
"aliases": [
"CVE-2022-26099"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.",
"id": "GHSA-2rcm-mm94-fj4v",
"modified": "2022-04-19T00:01:16Z",
"published": "2022-04-12T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26099"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RFF-FCFM-WV2Q
Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2025-11-26 00:30In the Linux kernel, the following vulnerability has been resolved:
net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect
After the call to phy_disconnect() netdev->phydev is reset to NULL. So fixed_phy_unregister() would be called with a NULL pointer as argument. Therefore cache the phy_device before this call.
{
"affected": [],
"aliases": [
"CVE-2025-38726"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-04T16:15:42Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect\n\nAfter the call to phy_disconnect() netdev-\u003ephydev is reset to NULL.\nSo fixed_phy_unregister() would be called with a NULL pointer as argument.\nTherefore cache the phy_device before this call.",
"id": "GHSA-2rff-fcfm-wv2q",
"modified": "2025-11-26T00:30:16Z",
"published": "2025-09-05T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38726"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/44bcd397ad9cd1a6b25fabb7f5edbee4fb0cfc2e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9ad90dd34b4e8e5be1e45a4559f4de0f14e53af2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ae59ec969c07c73f0610f8bd7e648f01e798d222"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e88fbc30dda1cb7438515303704ceddb3ade4ecd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RH3-VH92-3GCH
Vulnerability from github – Published: 2022-12-29 18:30 – Updated: 2023-01-06 00:30NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
{
"affected": [],
"aliases": [
"CVE-2022-4843"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-29T18:15:00Z",
"severity": "HIGH"
},
"details": "NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.",
"id": "GHSA-2rh3-vh92-3gch",
"modified": "2023-01-06T00:30:18Z",
"published": "2022-12-29T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4843"
},
{
"type": "WEB",
"url": "https://github.com/radareorg/radare2/commit/842f809d4ec6a12af2906f948657281c9ebc8a24"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/075b2760-66a0-4d38-b3b5-e9934956ab7f"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FOXRDPI3OYYKO4PKXE3XD2IFONL6BCHR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OFCCTYAD7ASNQ23ABCUPAZHEDEIOCW6T"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RMC-F234-XHG3
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2026-07-05 00:31A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2337.
{
"affected": [],
"aliases": [
"CVE-2020-21835"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-17T21:15:00Z",
"severity": "MODERATE"
},
"details": "A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2337.",
"id": "GHSA-2rmc-f234-xhg3",
"modified": "2026-07-05T00:31:18Z",
"published": "2022-05-24T19:02:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21835"
},
{
"type": "WEB",
"url": "https://github.com/LibreDWG/libredwg/issues/188#issuecomment-574493046"
},
{
"type": "WEB",
"url": "http://gnu.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RMF-WJ7V-G6M7
Vulnerability from github – Published: 2022-05-14 03:24 – Updated: 2022-05-14 03:24NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to denial of service or possible escalation of privileges.
{
"affected": [],
"aliases": [
"CVE-2018-6247"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-02T16:29:00Z",
"severity": "HIGH"
},
"details": "NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to denial of service or possible escalation of privileges.",
"id": "GHSA-2rmf-wj7v-g6m7",
"modified": "2022-05-14T03:24:12Z",
"published": "2022-05-14T03:24:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6247"
},
{
"type": "WEB",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4649"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2RQW-MG55-MP69
Vulnerability from github – Published: 2022-01-22 00:00 – Updated: 2022-01-29 00:01An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O__dtype_decode_helper () at hdf5/src/H5Odtype.c. This vulnerability can lead to a Denial of Service (DoS).
{
"affected": [],
"aliases": [
"CVE-2021-46243"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-21T21:15:00Z",
"severity": "MODERATE"
},
"details": "An untrusted pointer dereference vulnerability exists in HDF5 v1.13.1-1 via the function H5O__dtype_decode_helper () at hdf5/src/H5Odtype.c. This vulnerability can lead to a Denial of Service (DoS).",
"id": "GHSA-2rqw-mg55-mp69",
"modified": "2022-01-29T00:01:10Z",
"published": "2022-01-22T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46243"
},
{
"type": "WEB",
"url": "https://github.com/HDFGroup/hdf5/issues/1326"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2RV4-7MCW-PQ35
Vulnerability from github – Published: 2025-07-09 00:30 – Updated: 2025-07-09 00:30Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-49524"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T22:15:26Z",
"severity": "MODERATE"
},
"details": "Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-2rv4-7mcw-pq35",
"modified": "2025-07-09T00:30:32Z",
"published": "2025-07-09T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49524"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/illustrator/apsb25-65.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Select a programming language that is not susceptible to these issues.
Mitigation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.