CWE-822 — known CVE vulnerabilities

CVEs classified under CWE-822, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2025-50165 — CVSS 9.8 (critical): Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2023-1437 — CVSS 9.8 (critical): All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent…
• CVE-2026-48137 — CVSS 9.1 (critical): There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an…
• CVE-2025-4993 — CVSS 9.1 (critical): Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.This issue affects…
• CVE-2025-1255 — CVSS 9.1 (critical): Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.This issue affects…
• CVE-2024-36461 — CVSS 9.1 (critical): Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.
• CVE-2026-9771 — CVSS 8.8 (high): The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled…
• CVE-2026-50382 — CVSS 8.8 (high): Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.
• CVE-2026-33120 — CVSS 8.8 (high): Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2025-62549 — CVSS 8.8 (high): Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a…
• CVE-2025-27060 — CVSS 8.8 (high): Memory corruption while performing SCM call with malformed inputs.
• CVE-2024-43624 — CVSS 8.8 (high): Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
• CVE-2024-37340 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37339 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2023-0184 — CVSS 8.8 (high): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler which may lead to denial of…
• CVE-2023-0189 — CVSS 8.8 (high): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler which may lead to code execution, denial of…
• CVE-2022-34890 — CVSS 8.8 (high): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537)…
• CVE-2020-27259 — CVSS 8.8 (high): The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an…
• CVE-2020-26991 — CVSS 8.8 (high): A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected…
• CVE-2020-17392 — CVSS 8.8 (high): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. An attacker…
• CVE-2026-20738: Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may…
• CVE-2026-12364 — CVSS 8.4 (high): The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the…
• CVE-2026-8917: Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to…
• CVE-2026-15029: Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local…
• CVE-2026-40367 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-33114 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-26113 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2024-36352 — CVSS 8.4 (high): Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to…
• CVE-2025-20018 — CVSS 8.4 (high): Untrusted pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of…
• CVE-2025-24084 — CVSS 8.4 (high): Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.
• CVE-2025-21354 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-34023 — CVSS 8.4 (high): Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of…
• CVE-2024-40872 — CVSS 8.4 (high): There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07…
• CVE-2023-29360 — CVSS 8.4 (high) — actively exploited: Microsoft Streaming Service Elevation of Privilege Vulnerability
• CVE-2026-58596 — CVSS 8.3 (high): Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-19442 — CVSS 8.2 (high): IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver…
• CVE-2026-18840 — CVSS 8.2 (high): IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an…
• CVE-2023-42772 — CVSS 8.2 (high): Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable…
• CVE-2024-37969 — CVSS 8.0 (high): Secure Boot Security Feature Bypass Vulnerability
• CVE-2026-68810 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-64910 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-62737 — CVSS 7.8 (high): Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-45198 — CVSS 7.8 (high): Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot…
• CVE-2026-7406 — CVSS 7.8 (high): A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A…
• CVE-2026-24083 — CVSS 7.8 (high): Memory Corruption while processing IOCTL device driver requests with invalid arguments.
• CVE-2026-48340 — CVSS 7.8 (high): Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the…
• CVE-2026-55136 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-50479 — CVSS 7.8 (high): Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-50441 — CVSS 7.8 (high): Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-45643 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.