CWE-158 Improper Neutralization of Null Byte or NUL Character
variantThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (40)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-104286US | —OT critical | KEV | ||
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail… | ||||
| CVE-2025-47812US | —OT critical | KEV | ||
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be us… | ||||
| CVE-2009-1537US | high9.3OT critical | KEV | ||
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Wi… | ||||
| CVE-2015-8249US | critical9.8 | Exploit | ||
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter. | ||||
| CVE-2025-55113US | critical10.0 | — | ||
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlie… | ||||
| CVE-2020-14500US | critical9.8 | — | ||
Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data. | ||||
| CVE-2023-5719US | critical9.8 | — | ||
The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to… | ||||
| CVE-2026-33191US | high8.6 | — | ||
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2
are vulnerable to null byte injection in URL path parameter… | ||||
| CVE-2024-10921US | high8.1 | — | ||
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the Mong… | ||||
| CVE-2023-41105US | high7.5 | — | ||
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' by… | ||||
| CVE-2025-66263US | high7.5 | — | ||
Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500,… | ||||
| CVE-2022-41716US | high7.5 | — | ||
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable valu… | ||||
| CVE-2022-20812US | medium6.5 | — | ||
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remot… | ||||
| CVE-2020-7928US | medium6.5 | — | ||
A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects MongoDB Server v4.4 ve… | ||||
| CVE-2020-5363US | medium6.7 | — | ||
Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of… | ||||
| CVE-2022-20813US | medium5.9 | — | ||
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remot… | ||||
| CVE-2025-38283US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
hisi_acc_vfio_pci: bugfix live migration function without VF device driver
If the VF device driver is not load… | ||||
| CVE-2023-52763US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
The `i3c_master_bus_init` function may a… | ||||
| CVE-2024-0408US | medium5.5 | — | ||
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to acc… | ||||
| CVE-2026-4359US | low3.7 | — | ||
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan