1725
Scope Impact Likelihood
If the untrusted pointer references a memory location that
is not accessible to the product, or points to a location that
is "malformed" or larger than expected by a read or write
operation, the application may terminate unexpectedly.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Modify Memory
If the untrusted pointer is used in a function call, or
points to unexpected data in a write operation, then code
execution may be possible.
Observed Examples
Reference Description
CVE-2007-5655 message-passing framework interprets values in packets as pointers, causing
a crash.
https://www.cve.org/CVERecord?id=CVE-2007-5655
CVE-2010-2299 labeled as a "type confusion" issue, also referred to as a "stale pointer."
However, the bug ID says "contents are simply interpreted as a pointer...
renderer ordinarily doesn't supply this pointer directly". The "handle" in
the untrusted area is replaced in one function, but not another - thus also,
effectively, exposure to wrong sphere (CWE-668).
https://www.cve.org/CVERecord?id=CVE-2010-2299
CVE-2009-1719 Untrusted dereference using undocumented constructor.
https://www.cve.org/CVERecord?id=CVE-2009-1719
CVE-2009-1250 An error code is incorrectly checked and interpreted as a pointer, leading to a
crash.
https://www.cve.org/CVERecord?id=CVE-2009-1250
CVE-2009-0311 An untrusted value is obtained from a packet and directly called as a function
pointer, leading to code execution.
https://www.cve.org/CVERecord?id=CVE-2009-0311
CVE-2010-1818 Undocumented attribute in multimedia software allows "unmarshaling" of an
untrusted pointer.
https://www.cve.org/CVERecord?id=CVE-2010-1818
CVE-2010-3189 ActiveX control for security software accepts a parameter that is assumed to
be an initialized pointer.
https://www.cve.org/CVERecord?id=CVE-2010-3189
CVE-2010-1253 Spreadsheet software treats certain record values that lead to "user-controlled
pointer" (might be untrusted offset, not untrusted pointer).
https://www.cve.org/CVERecord?id=CVE-2010-1253
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
CWE Version 4.14
CWE-823: Use of Out-of-range Pointer Offset
CWE-823: Use of Out-of-range Pointer Offset