Cyber Resilience

CWE · MITRE source

CWE-476NULL Pointer Dereference

Abstraction: Base · CVEs in our corpus: 5,550

The product dereferences a pointer that it expects to be valid but is NULL.

Last updated: 22 August 2026 14:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
  • SA-8 Security and Privacy Engineering Principles
  • SA-15 Development Process, Standards, and Tools
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-44224 8.88.20.82292021-12-20
CVE-2017-3169 8.59.80.19952017-06-20
CVE-2023-21758 8.57.50.92532023-01-10
CVE-2016-0742 8.47.50.81962016-02-15
CVE-2023-21547 8.47.50.89282023-01-10
CVE-2018-4987 8.39.80.13492018-07-09
CVE-2021-26690 8.37.50.65312021-06-10
CVE-2023-38171 8.37.50.69492023-10-10
CVE-2025-22037 8.37.50.66422025-04-16
CVE-2015-8787 8.29.80.09242016-02-08
CVE-2020-13934 8.27.50.64122020-07-14
CVE-2021-34798 8.27.50.64512021-09-16
CVE-2017-1000471 8.19.80.08612018-01-03
CVE-2017-12627 8.19.80.08362018-03-01
CVE-2004-0389 8.07.50.54922004-06-01
CVE-2016-5689 8.09.80.05442016-12-13
CVE-2016-5690 8.09.80.05442016-12-13
CVE-2017-3730 8.07.50.55292017-05-04
CVE-2017-7659 8.07.50.53942017-07-26
CVE-2018-8011 8.07.50.56042018-07-18
CVE-2018-17893 8.09.80.06382018-10-17
CVE-2020-1967 8.07.50.53342020-04-21
CVE-2025-21285 8.07.50.55692025-01-14
CVE-2017-18211 7.99.80.03892018-03-01
CVE-2017-15120 7.97.50.51792018-07-27