CWE-476: NULL Pointer Dereference

Code Examples & CVEs

Demonstrative Examples

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.

If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy().

BadC

void host_lookup(char *user_supplied_addr){                         struct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);                                                        /*routine that ensures user_supplied_addr is in the right format for conversion */                                                        validate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);                      }

In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a NULL pointer exception when it attempts to call the trim() method.

BadJava

String cmd = System.getProperty("cmd");cmd = cmd.trim();

This Android application has registered to handle a URL when sent an intent:

The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.

BadJava

...                      IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);                      ...                                            public class UrlHandlerReceiver extends BroadcastReceiver {                         @Overridepublic void onReceive(Context context, Intent intent) {                               if("com.example.URLHandler.openURL".equals(intent.getAction())) {String URL = intent.getStringExtra("URLToOpen");int length = URL.length();                                                                    ...                                  }                            }                      }

Consider the following example of a typical client server exchange. The HandleRequest function is intended to perform a request and use a defer to close the connection whenever the function returns.

If a user supplies a malformed request or violates the client policy, the Do method can return a nil response and a non-nil err.

BadGo

func HandleRequest(client http.Client, request *http.Request) (*http.Response, error) {                                               response, err := client.Do(request)                         defer response.Body.Close()                         if err != nil {                                                           return nil, err                                                     }...                      }

Observed CVE Examples (25)

CVE-2024-41130

C++ library for LLM inference has NULL pointer dereference if a read operation fails

View Details

CVE-2005-3274

race condition causes a table to be corrupted if a timer activates while it is being modified, leading to resultant NULL dereference; also involves locking.

View Details

CVE-2002-1912

large number of packets leads to NULL dereference

View Details

CVE-2005-0772

packet with invalid error status value triggers NULL dereference

View Details

CVE-2009-4895

Chain: race condition for an argument value, possibly resulting in NULL dereference

View Details

CVE-2020-29652

ssh component for Go allows clients to cause a denial of service (nil pointer dereference) against SSH servers.

View Details

CVE-2009-2692

Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476).

View Details

CVE-2009-3547

Chain: race condition (CWE-362) might allow resource to be released before operating on it, leading to NULL dereference (CWE-476)

View Details

CVE-2009-3620

Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference

View Details

CVE-2009-2698

Chain: IP and UDP layers each track the same value with different mechanisms that can get out of sync, possibly resulting in a NULL dereference

View Details

CVE-2009-2692

Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476)

View Details

CVE-2009-0949

Chain: improper initialization of memory can lead to NULL dereference

View Details

CVE-2008-3597

Chain: game server can access player data structures before initialization has happened leading to NULL dereference

View Details

CVE-2020-6078

Chain: The return value of a function returning a pointer is not checked for success (CWE-252) resulting in the later use of an uninitialized variable (CWE-456) and a null pointer dereference (CWE-476)

View Details

CVE-2008-0062

Chain: a message having an unknown message type may cause a reference to uninitialized memory resulting in a null pointer dereference (CWE-476) or dangling pointer (CWE-825), possibly crashing the system or causing heap corruption.

View Details

CVE-2008-5183

Chain: unchecked return value can lead to NULL dereference

View Details

CVE-2004-0079

SSL software allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

View Details

CVE-2004-0365

Network monitor allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.

View Details

CVE-2003-1013

Network monitor allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference.

View Details

CVE-2003-1000

Chat client allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.

View Details

CVE-2004-0389

Server allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference.

View Details

CVE-2004-0119

OS allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted request during authentication protocol selection.

View Details

CVE-2004-0458

Game allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference.

View Details

CVE-2002-0401

Network monitor allows remote attackers to cause a denial of service (crash) or execute arbitrary code via malformed packets that cause a NULL pointer dereference.

View Details

CVE-2001-1559

Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-476 trust boundary

MITRE identifies automated dynamic analysis, manual dynamic analysis, automated static analysis as applicable detection approaches. Use them to trace nullable allocations, lookups, casts, and optional values to their first dereference, especially in initialization failures and rarely executed error paths. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-476: detection methods and operational guidance — MITRE CWE

Check every nullable pointer before its first use

Validate pointer parameters before passing them to functions such as strlen or memcpy, and check every allocation result before dereferencing it. Perform the null check before any member access or derived-pointer initialization; a check that appears after a dereference is already too late and may be removed by compiler optimization. Handle the failure path explicitly and use static analysis to find unchecked null returns and null tests that occur after use.

EXP34-C: Do not dereference null pointers — Carnegie Mellon SEI

Apply lessons from CVE-2025-24177 in Apple macOS, iOS, and iPadOS

NVD maps CVE-2025-24177 to CWE-476; a remotely triggerable null-pointer dereference could cause denial of service and was addressed with improved input validation. Use the case to test malformed remote inputs, validate optional parse results before use, and ensure a rejected value cannot advance into a dereference or leave the service in a crash loop.

CVE-2025-24177 Detail — NIST National Vulnerability Database

Prioritize CWE-476 using its 2025 CWE Top 25 evidence

CWE-476 ranked #13 in the 2025 CWE Top 25 with a score of 6.41. The ranking table recorded no mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Exercise nullable failure paths with runtime sanitizers

Enable null-related UndefinedBehaviorSanitizer checks for supported native targets and force allocation failures, missing lookups, absent optional values, malformed inputs, and partial initialization. Assert that the program checks before the first dereference and enters a defined failure path. Keep sanitizer diagnostics symbolized in CI and supplement them with static nullability analysis for paths tests do not execute.

UndefinedBehaviorSanitizer — LLVM Project

Frequently Asked Questions

What is CWE-476: NULL Pointer Dereference?+

CWE-476: NULL Pointer Dereference is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product dereferences a pointer that it expects to be valid but is NULL.

Is CWE-476 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-476 ranked #11 in the CWE Top 25 for 2024, associated with 1,625 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of NULL Pointer Dereference?+

If exploited, CWE-476 (NULL Pointer Dereference) it can compromise Availability, Integrity and Confidentiality, leading to outcomes such as DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Read Memory and Modify Memory.

How do you prevent or mitigate NULL Pointer Dereference?+

Recommended mitigations for CWE-476 include: Select a programming language that is not susceptible to these issues. Check the results of all functions that return a value and verify that the value is non-null before acting upon it. Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.

Which programming languages are affected by NULL Pointer Dereference?+

CWE-476 commonly affects C, C++, Java, C# and Go. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of NULL Pointer Dereference?+

MITRE documents real CVEs mapped to CWE-476, including CVE-2024-41130, CVE-2005-3274, CVE-2002-1912, CVE-2005-0772 and CVE-2009-4895. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-476 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-476: NULL Pointer Dereference

Technical Details

Applicable To

🏆 CWE Top 25 Historical Ranking

Security Consequences

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Effectiveness

Phase

Description

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (25)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-476 trust boundary

Check every nullable pointer before its first use

Apply lessons from CVE-2025-24177 in Apple macOS, iOS, and iPadOS

Prioritize CWE-476 using its 2025 CWE Top 25 evidence

Exercise nullable failure paths with runtime sanitizers

Frequently Asked Questions

Learn More