Cyber Resilience

CVE-2023-48727

Published
16 May 2024
Modified
15 April 2026
CVSS Score v3.1 3.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0024 15th percentile
Risk Priority 29 floored blend · peak EPSS

Summary

CVE-2023-48727 is a low-severity Use of NullPointerException Catch to Detect NULL Pointer Dereference (CWE-395) vulnerability in Intel (inferred from references). Its CVSS base score is 3.3 (Low).

Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

NULL pointer dereference in some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable information disclosure via local access.

CWE(s)
CWE-395

Related Threats

CVEs Like This One

CVE-2024-27658Shared CWE-395
CVE-2024-36275Shared CWE-395
CVE-2023-41082Shared CWE-395
CVE-2025-58142Shared CWE-395
CVE-2024-28030Shared CWE-395
CVE-2024-27659Shared CWE-395
CVE-2023-23904Shared CWE-395
CVE-2025-27466Shared CWE-395
CVE-2024-27661Shared CWE-395
CVE-2024-27662Shared CWE-395

Affected Assets

Intel
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover catch blocks used for null detection during code review or dynamic analysis.

SA-15 Development Process, Standards, and Tools partial match

Documented development standards and tools can mandate explicit null checks instead of relying on exception handlers.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce proper null handling via reviews and tooling rather than exception catching.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect improper exception handling but does not prevent the coding practice itself.

A.8.28 Secure coding partial match
prevents

Secure coding rules explicitly forbid catching NullPointerException to detect null dereferences.

References