CWE Top 25 2025, rank 13CWE-476
NULL Pointer Dereference
CWE-476: NULL Pointer Dereference
A NULL pointer dereference happens when code uses a pointer that is NULL, usually because a function that can fail was assumed to succeed. In user-space programs the typical result is a crash, which makes it a denial-of-service weakness for any service an attacker can trigger remotely. In older kernels, or where low memory can be mapped, it has also been exploited for privilege escalation.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A server calls malloc() under memory pressure, ignores the NULL return, and crashes when it writes to the result.
- A certificate parser assumes an optional field is present and dereferences it, letting a crafted certificate crash every client that validates it.
- A lookup function returns NULL for an unknown session id, and the caller uses the result without checking.
How to mitigate it
- Check the return value of every function that can fail, including allocation and lookup functions, before using the result.
- Use language features that make absence explicit, such as Optional types or non-nullable references.
- Run static analysis that tracks nullability and flag unchecked returns in code review.
- Design services to restart cleanly and rate-limit inputs so a crash bug cannot be turned into a sustained outage.
Go deeper
Practice this topic
Test your knowledge of NULL Pointer Dereference with exam-style practice questions.