CWE-822— Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.— MITRE CWE catalog
308 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-822page 7 of 7
- CVE-2025-58749MEDIUMCVSS 5.3EG 5.32025-09-16
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memo…
- CVE-2018-7525MEDIUMCVSS 5.3EG 5.32018-03-21
In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.
- CVE-2026-75432MEDIUMCVSS 5.1EG 5.12026-09-22
An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scanner::PushIndentTo() components
- CVE-2026-102186MEDIUMCVSS 4.7EG 4.72026-10-13
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
- CVE-2025-60728MEDIUMCVSS 4.3EG 4.32025-11-11
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
- CVE-2026-96393LOWCVSS 3.6EG 3.62026-10-09
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document t…
- CVE-2021-20239LOWCVSS 3.3EG 3.32021-05-28
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to con…
- CVE-2021-26410LOWCVSS 1.8EG 1.82026-02-10
Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential infor…
Map vulnerabilities like CWE-822 to your infrastructure
EchelonGraph correlates every CVE — across CWE-822 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →