NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

We track 682 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 1 has been exploited in real attacks.

How this weakness is prevented

• Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
• Requirements: Select a programming language that is not susceptible to these issues.
• Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
• Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
• Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.