Cyber Resilience

CWE · MITRE source

CWE-476NULL Pointer Dereference

Abstraction: Base · CVEs in our corpus: 5,332

The product dereferences a pointer that it expects to be valid but is NULL.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 2 framework(s): ATT&CK 2 (partial) · OWASP-Web 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A10:2025 Mishandling of Exceptional Conditions.

NIST 800-53 r5 controls that address this weakness (0)AI

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1489 Service Stop→PT1499 Endpoint Denial of Service←P →MT1499.004 Application or System Exploitation←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2026-21525 KEV10.06.20.04962026-02-10
CVE-2004-03898.07.50.52492004-06-01
CVE-2006-65658.00.00.70302006-12-15
CVE-2009-13868.00.00.80132009-06-04
CVE-2014-34708.00.00.85782014-06-05
CVE-2014-97088.00.00.56432015-03-31
CVE-2016-07428.07.50.81962016-02-15
CVE-2017-37308.07.50.55292017-05-04
CVE-2017-76598.07.50.53942017-07-26
CVE-2018-80118.07.50.51712018-07-18
CVE-2017-151208.07.50.51792018-07-27
CVE-2019-100978.07.20.52872019-09-26
CVE-2020-19678.07.50.53342020-04-21
CVE-2020-139348.07.50.64122020-07-14
CVE-2021-34498.05.90.62912021-03-25
CVE-2021-266908.07.50.65072021-06-10
CVE-2021-316188.07.50.51212021-06-15
CVE-2021-347988.07.50.64512021-09-16
CVE-2021-442248.08.20.82292021-12-20
CVE-2022-447928.06.50.52052022-11-07
CVE-2022-447938.06.50.53462022-11-07
CVE-2023-215478.07.50.88232023-01-10
CVE-2023-217588.07.50.91602023-01-10
CVE-2023-381718.07.50.69492023-10-10
CVE-2025-212858.07.50.54842025-01-14