CWE-170 Improper Null Termination
baseThe product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (80)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22931US | critical9.8 | — | ||
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name S… | ||||
| CVE-2021-1411US | critical9.9 | — | ||
Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the und… | ||||
| CVE-2021-31886US | critical9.8 | — | ||
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC… | ||||
| CVE-2021-31884US | critical9.8 | — | ||
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC… | ||||
| CVE-2019-8275US | critical9.8 | — | ||
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack appe… | ||||
| CVE-2018-1000101US | critical9.8 | — | ||
Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf that can result in Th… | ||||
| CVE-2026-42010US | critical9.8 | — | ||
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated username… | ||||
| CVE-2025-67733US | high7.1 | Exploit | ||
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the… | ||||
| CVE-2020-24383US | critical9.1 | — | ||
An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\0' termination of the resource record name string… | ||||
| CVE-2021-31888US | high8.8 | — | ||
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC… | ||||
| CVE-2021-31887US | high8.8 | — | ||
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC… | ||||
| CVE-2026-34464US | high8.8 | — | ||
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_… | ||||
| CVE-2026-24852US | high8.1 | — | ||
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer… | ||||
| CVE-2019-11044US | high7.5 | — | ||
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte… | ||||
| CVE-2026-83781US | high7.8 | — | ||
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-34462US | high7.8 | — | ||
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, an… | ||||
| CVE-2023-36907US | high7.5 | — | ||
Windows Cryptographic Services Information Disclosure Vulnerability | ||||
| CVE-2023-36906US | high7.5 | — | ||
Windows Cryptographic Services Information Disclosure Vulnerability | ||||
| CVE-2021-36762US | high7.5 | — | ||
An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't ensure that a filename is adequately '\0'… | ||||
| CVE-2020-17440US | high7.5 | — | ||
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS resp… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan