CWE-822
CWE-822 · 59 records · 12 with a public proof-of-concept
Records the NVD classes under CWE-822, highest CVSS first.
- CRITICAL 9.8CVE-2026-96924
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- CRITICAL 9.8CVE-2026-70300
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
365 apps · office 2021 · office 2024
- CRITICAL 9.8CVE-2026-103764public PoC
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted Session…
- CRITICAL 9.3CVE-2026-113780public PoC
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied sta…
- HIGH 8.8CVE-2026-16511public PoC
Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller…
- HIGH 8.8CVE-2026-88219
Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-88116
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-88114
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-88112
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-85903
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 8.8CVE-2026-70275
Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70167
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
windows server 2022 · windows server 2025
- HIGH 8.8CVE-2026-70068
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.8CVE-2026-94403
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The …
- HIGH 8.2CVE-2026-121996
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeati…
- HIGH 8.1CVE-2026-70111
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
- HIGH 8.1CVE-2026-58007
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- HIGH 8.1CVE-2026-58006
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- HIGH 7.8CVE-2026-87041public PoC
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on K…
- HIGH 7.8CVE-2026-19676public PoC
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the ou…
- HIGH 7.8CVE-2026-96933
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96931
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-96847
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88126
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83848
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83826
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83587
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70172
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70104
Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69850
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-57545
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
snapdragon g1 gen 2 gaming platform firmware · snapdragon g1 gen 2 gaming platform · ar8031 firmware · ar8031 · cologne firmware · cologne
- HIGH 7.8CVE-2026-19185public PoC
The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. …
- HIGH 7.8CVE-2026-91795
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially en…
- HIGH 7.8CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
qam8295p firmware · qam8295p · qca6696 firmware · qca6696 · sa8295p firmware · sa8295p
- HIGH 7.5CVE-2026-105723
Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.
- HIGH 7.1CVE-2026-105729
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
- HIGH 7.1CVE-2026-100205
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-96216
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7CVE-2026-88098
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.8CVE-2026-103578
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.8CVE-2026-102188
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
- MEDIUM 6.7CVE-2026-69902
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.5CVE-2026-108435
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
- MEDIUM 6.5CVE-2026-88203
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
365 apps · office 2021 · office 2024
- MEDIUM 6.5CVE-2026-70170
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.
- MEDIUM 6.4CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validat…
- MEDIUM 6.1CVE-2026-19595public PoC
The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_r…
- MEDIUM 5.5CVE-2026-110322public PoC
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
- MEDIUM 5.5CVE-2026-96910
Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-85909
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70270
Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.
- MEDIUM 4.7CVE-2026-102186
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
- LOW 3.6CVE-2026-96393
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a…
- UNSCOREDCVE-2026-115653public PoC
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer a…
- UNSCOREDCVE-2026-88781
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash. Refer t…
- UNSCOREDCVE-2026-43598
Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution.
- UNSCOREDCVE-2026-102757public PoC
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided wheth…
- UNSCOREDCVE-2026-102710public PoC
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as …
- UNSCOREDCVE-2026-102709public PoC
Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these atta…