CWE-822— Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.— MITRE CWE catalog
306 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-822page 4 of 7
- CVE-2025-49689HIGHCVSS 7.8EG 7.82025-07-08
Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-49661HIGHCVSS 7.8EG 7.82025-07-08
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- CVE-2025-47985HIGHCVSS 7.8EG 7.82025-07-08
Untrusted pointer dereference in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
- CVE-2025-47982HIGHCVSS 7.8EG 7.82025-07-08
Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
- CVE-2025-21486HIGHCVSS 7.8EG 7.82025-06-03
Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
- CVE-2025-30381HIGHCVSS 7.8EG 7.82025-05-13
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- CVE-2025-29812HIGHCVSS 7.8EG 7.82025-04-08
Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
- CVE-2025-27747HIGHCVSS 7.8EG 7.82025-04-08
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2025-27739HIGHCVSS 7.8EG 7.82025-04-08
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CVE-2025-24083HIGHCVSS 7.8EG 7.82025-03-11
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2024-53034HIGHCVSS 7.8EG 7.82025-03-03
Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.
- CVE-2024-53033HIGHCVSS 7.8EG 7.82025-03-03
Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.
- CVE-2025-21381HIGHCVSS 7.8EG 7.82025-02-11
Microsoft Excel Remote Code Execution Vulnerability
- CVE-2025-21358HIGHCVSS 7.8EG 7.82025-02-11
Windows Core Messaging Elevation of Privileges Vulnerability
- CVE-2024-45584HIGHCVSS 7.8EG 7.82025-02-03
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
- CVE-2025-21363HIGHCVSS 7.8EG 7.82025-01-14
Microsoft Word Remote Code Execution Vulnerability
- CVE-2024-49090HIGHCVSS 7.8EG 7.82024-12-12
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2024-43636HIGHCVSS 7.8EG 7.82024-11-12
Win32k Elevation of Privilege Vulnerability
- CVE-2024-43629HIGHCVSS 7.8EG 7.82024-11-12
Windows DWM Core Library Elevation of Privilege Vulnerability
- CVE-2024-43516HIGHCVSS 7.8EG 7.82024-10-08
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
- CVE-2024-21455HIGHCVSS 7.8EG 7.82024-10-07
Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.
- CVE-2024-33038HIGHCVSS 7.8EG 7.82024-09-02
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
- CVE-2024-38187HIGHCVSS 7.8EG 7.82024-08-13
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- CVE-2024-38185HIGHCVSS 7.8EG 7.82024-08-13
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- CVE-2024-0091HIGHCVSS 7.8EG 7.82024-06-13
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might lead to denial of service, informa…
- CVE-2023-40472HIGHCVSS 7.8EG 7.82024-05-03
PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction …
- CVE-2023-40471HIGHCVSS 7.8EG 7.82024-05-03
PDF-XChange Editor App Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to…
- CVE-2023-39501HIGHCVSS 7.8EG 7.82024-05-03
PDF-XChange Editor OXPS File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction …
- CVE-2023-35711HIGHCVSS 7.8EG 7.82024-05-03
Ashlar-Vellum Cobalt XE File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interactio…
- CVE-2023-34311HIGHCVSS 7.8EG 7.82024-05-03
Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to…
- CVE-2023-34309HIGHCVSS 7.8EG 7.82024-05-03
Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to…
- CVE-2023-34301HIGHCVSS 7.8EG 7.82024-05-03
Ashlar-Vellum Cobalt CO File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interactio…
- CVE-2023-34300HIGHCVSS 7.8EG 7.82024-05-03
Ashlar-Vellum Cobalt XE File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interactio…
- CVE-2023-27342HIGHCVSS 7.8EG 7.82024-05-03
PDF-XChange Editor EMF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction i…
- CVE-2024-23136HIGHCVSS 7.8EG 7.82024-02-22
A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current …
- CVE-2024-21346HIGHCVSS 7.8EG 7.82024-02-13
Win32k Elevation of Privilege Vulnerability
- CVE-2023-34333HIGHCVSS 7.8EG 7.82024-01-09
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrit…
- CVE-2023-34332HIGHCVSS 7.8EG 7.82024-01-09
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity…
- CVE-2024-20682HIGHCVSS 7.8EG 7.82024-01-09
Windows Cryptographic Services Remote Code Execution Vulnerability
- CVE-2023-36011HIGHCVSS 7.8EG 7.82023-12-12
Win32k Elevation of Privilege Vulnerability
- CVE-2023-41139HIGHCVSS 7.8EG 7.82023-11-23
A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
- CVE-2023-36045HIGHCVSS 7.8EG 7.82023-11-14
Microsoft Office Graphics Remote Code Execution Vulnerability
- CVE-2023-25515HIGHCVSS 7.8EG 7.82023-06-23
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data is parsed, which may lead to code execution, denial of service, escalation of privileges, data tampering, or information disclosure…
- CVE-2022-42418HIGHCVSS 7.8EG 7.82023-01-26
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malic…
- CVE-2022-42396HIGHCVSS 7.8EG 7.82023-01-26
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malic…
- CVE-2022-2002HIGHCVSS 7.8EG 7.82022-12-07
GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
- CVE-2022-2894HIGHCVSS 7.8EG 7.82022-08-31
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.
- CVE-2021-38401HIGHCVSS 7.8EG 7.82021-12-20
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to execute arbitrary code and cause the application to crash.
- CVE-2021-31504HIGHCVSS 7.8EG 7.82021-08-03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (package 16.6.3.134). User interaction is required to exploit this vulnerability in that the target m…
- CVE-2021-31500HIGHCVSS 7.8EG 7.82021-06-15
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …
Map vulnerabilities like CWE-822 to your infrastructure
EchelonGraph correlates every CVE — across CWE-822 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →