CWE-476— NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.— MITRE CWE catalog

5,487 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-476page 32 of 110

CVE-2021-30500HIGHCVSS 7.8EG 7.8
2021-05-27
Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
CVE-2021-30698HIGHCVSS 7.5EG 7.5
2021-09-08
A null pointer dereference was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, Safari 14.1.1, iOS 14.6 and iPadOS 14.6. A remote attacker may be able to cause a denial of service.
CVE-2021-3119HIGHCVSS 7.5EG 7.5
2021-03-25
Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL…
CVE-2021-31257MEDIUMCVSS 5.5EG 5.5
2021-04-19
The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-31258MEDIUMCVSS 5.5EG 5.5
2021-04-19
The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-31259MEDIUMCVSS 5.5EG 5.5
2021-04-19
The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-31260MEDIUMCVSS 5.5EG 5.5
2021-04-19
The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-31262MEDIUMCVSS 5.5EG 5.5
2021-04-19
The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-31618HIGHCVSS 7.5EG 8.1
2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP res…
CVE-2021-31826HIGHCVSS 7.5EG 7.5
2021-04-27
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.
CVE-2021-32132MEDIUMCVSS 5.5EG 5.5
2021-09-13
The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32134MEDIUMCVSS 5.5EG 5.5
2021-09-13
The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32135MEDIUMCVSS 5.5EG 5.5
2021-09-13
The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32138MEDIUMCVSS 5.5EG 5.5
2021-09-13
The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32139MEDIUMCVSS 5.5EG 5.5
2021-09-13
The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32269MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function ilst_item_box_dump located in box_dump.c. It allows an attacker to cause Denial of Service.
CVE-2021-32270MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function vwid_box_del located in box_code_base.c. It allows an attacker to cause Denial of Service.
CVE-2021-32275MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in faust through v2.30.5. A NULL pointer dereference exists in the function CosPrim::computeSigOutput() located in cosprim.hh. It allows an attacker to cause Denial of Service.
CVE-2021-32276MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
CVE-2021-32280MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in fig2dev before 3.2.8.. A NULL pointer dereference exists in the function compute_closed_spline() located in trans_spline.c. It allows an attacker to cause Denial of Service. The fixed version of fig2dev is 3.2.8.
CVE-2021-32282MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_add_check() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVE-2021-32283MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function gravity_string_to_value() located in gravity_value.c. It allows an attacker to cause Denial of Service.
CVE-2021-32284HIGHCVSS 7.8EG 7.8
2021-09-20
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_register_pop_context_protect() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVE-2021-32285MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function list_iterator_next() located in gravity_core.c. It allows an attacker to cause Denial of Service.
CVE-2021-32289MEDIUMCVSS 5.5EG 5.5
2021-09-20
An issue was discovered in heif through through v3.6.2. A NULL pointer dereference exists in the function convertByteStreamToRBSP() located in nalutil.cpp. It allows an attacker to cause Denial of Service.
CVE-2021-3236MEDIUMCVSS 5.5EG 5.5
2023-08-11
vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.
CVE-2021-32437MEDIUMCVSS 5.5EG 5.5
2021-08-11
The gf_hinter_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32438MEDIUMCVSS 5.5EG 5.5
2021-08-11
The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32440MEDIUMCVSS 5.5EG 5.5
2021-08-11
The Media_RewriteODFrame function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2021-32611HIGHCVSS 7.5EG 7.5
2021-05-12
A NULL pointer dereference vulnerability exists in eXcall_api.c in Antisip eXosip2 through 5.2.0 when handling certain 3xx redirect responses.
CVE-2021-32843MEDIUMCVSS 6.2EG 6.2
2023-02-17
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This…
CVE-2021-32844MEDIUMCVSS 6.2EG 6.2
2023-02-17
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash…
CVE-2021-32963HIGHCVSS 7.5EG 7.5
2021-09-23
Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
CVE-2021-32971HIGHCVSS 7.5EG 7.5
2021-09-23
Null pointer dereference in SuiteLink server while processing command 0x07
CVE-2021-32979HIGHCVSS 7.5EG 7.5
2021-09-23
Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
CVE-2021-32987HIGHCVSS 7.5EG 7.5
2021-09-23
Null pointer dereference in SuiteLink server while processing command 0x0b
CVE-2021-33068MEDIUMCVSS 6.5EG 6.5
2022-02-09
Null pointer dereference in subsystem for Intel(R) AMT before versions 15.0.35 may allow an authenticated user to potentially enable denial of service via network access.
CVE-2021-3319MEDIUMCVSS 6.5EG 6.5
2021-10-05
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see htt…
CVE-2021-3320MEDIUMCVSS 5.9EG 5.9
2021-05-25
Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-27r3-rxch-2hm7
CVE-2021-3322MEDIUMCVSS 6.5EG 6.5
2021-10-12
Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHS…
CVE-2021-33254HIGHCVSS 7.5EG 7.5
2022-06-02
An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function.
CVE-2021-33317HIGHCVSS 7.5EG 7.5
2022-05-11
The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. This vulnerability exists in its lldp related component. Due to fail to check if ChassisID TLV is contained in the pa…
CVE-2021-33439MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
CVE-2021-33440MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
CVE-2021-33441MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
CVE-2021-33442MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
CVE-2021-33444MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
CVE-2021-33445MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
CVE-2021-33446MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
CVE-2021-33447MEDIUMCVSS 5.5EG 5.5
2022-07-26
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.

Map vulnerabilities like CWE-476 to your infrastructure

EchelonGraph correlates every CVE — across CWE-476 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →