CWE-158 · Injection and Smuggling
Improper Neutralization of Null Byte or NUL Character
37CVEs
SortMost likely exploited
37 CVEs with CWE-158 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-47812In CISA KEVExploitedWing FTP Server <= 7.4.3 - Remote Code Executionwftpserver · Wing FTP Server · CVSS 10 · 2025-07-10 | 10.0 | 94% | 2025-07-10 |
| CVE-2009-1537In CISA KEVExploitedUnspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and W…Microsoft · DirectX · CVSS 8.8 · 2009-05-29 | 8.8 | 51% | 2009-05-29 |
| CVE-2022-20812Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco · Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 9 · 2022-07-06 | 9.0 | 2.0% | 2022-07-06 |
| CVE-2020-14500IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158Secomea GateManager all versions prior to 9.2c · Secomea GateManager all versions prior to 9.2c · CVSS 10 · 2020-08-25 | 10.0 | 1.7% | 2020-08-25 |
| CVE-2020-7928Improper neutralization of null byte leads to read overrunMongoDB Inc. · MongoDB Server · CVSS 6.5 · 2020-11-23 | 6.5 | 1.4% | 2020-11-23 |
| CVE-2022-20813Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco · Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 9 · 2022-07-06 | 9.0 | 1.1% | 2022-07-06 |
| CVE-2022-41716Unsanitized NUL in environment variables on Windows in syscall and os/execGo standard library · syscall · CVSS 6.3 · 2022-11-02 | 6.3 | 1.0% | 2022-11-02 |
| CVE-2026-105239Apache log4net: NUL character truncates EventLogAppender recordsApache Software Foundation · Apache log4net · CVSS 5.3 · 2026-10-06 | 5.3 | 0.8% | 2026-10-06 |
| CVE-2026-105240Apache log4net: NUL character truncates OutputDebugStringAppender recordsApache Software Foundation · Apache log4net · CVSS 5.3 · 2026-10-06 | 5.3 | 0.8% | 2026-10-06 |
| CVE-2025-9648Denial of Service in CivetWebCivetWeb · CivetWeb · CVSS 8.7 · 2025-09-29 | 8.7 | 0.8% | 2025-09-29 |
| CVE-2023-5719Red Lion Crimson Improper Neutralization of Null Byte or NUL CharacterRed Lion · Crimson · CVSS 8.8 · 2023-11-06 | 8.8 | 0.6% | 2023-11-06 |
| CVE-2024-10921Improper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerMongoDB Inc · MongoDB Server · CVSS 6.8 · 2024-11-14 | 6.8 | 0.6% | 2024-11-14 |
| CVE-2026-23863An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename…Facebook · WhatsApp Desktop for Windows · CVSS 6.5 · 2026-05-01 | 6.5 | 0.5% | 2026-05-01 |
| CVE-2024-9026PHP-FPM logs from children may be alteredPHP Group · PHP · CVSS 3.3 · 2024-10-08 | 3.3 | 0.5% | 2024-10-08 |
| CVE-2025-14388PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injectionkiboit · PhastPress · CVSS 9.8 · 2025-12-23 | 9.8 | 0.5% | 2025-12-23 |
| CVE-2026-105475Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.WebPros · cPanel · CVSS 8.7 · 2026-11-02 | 8.7 | 0.5% | 2026-11-02 |
| CVE-2025-1936Adding %00 and a fake extension to a jar: URL changed the interpretation of the contentsMozilla · Firefox · CVSS 7.3 · 2025-03-04 | 7.3 | 0.4% | 2025-03-04 |
| CVE-2026-76354Path Traversal through Search Head Clustering in Splunk EnterpriseSplunk · Splunk Enterprise · CVSS 8.1 · 2026-08-19 | 8.1 | 0.4% | 2026-08-19 |
| CVE-2025-66263Unauthenticated Arbitrary File Read via Null Byte InjectionDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter · CVSS 8.9 · 2025-11-26 | 8.9 | 0.4% | 2025-11-26 |
| CVE-2026-33191free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Errorfree5gc · free5gc · CVSS 8.7 · 2026-03-20 | 8.7 | 0.4% | 2026-03-20 |
| CVE-2026-124077Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)Apache Software Foundation · Apache Commons Codec · CVSS 4.3 · 2026-11-09 | 4.3 | 0.3% | 2026-11-09 |
| CVE-2020-5363Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of…Dell · Dell Client Consumer and Commercial platforms · CVSS 8.6 · 2020-06-10 | 8.6 | 0.3% | 2020-06-10 |
| CVE-2024-0408Xorg-x11-server: selinux unlabeled glx pbufferRedhat · xorg-server · CVSS 5.5 · 2024-01-18 | 5.5 | 0.3% | 2024-01-18 |
| CVE-2025-55113BMC Control-M/Agent unescaped NULL byte in access control list checksBMC · Control-M/Agent · CVSS 9 · 2025-09-16 | 9.0 | 0.3% | 2025-09-16 |
| CVE-2026-116566socket.getaddrinfo() accepts embedded null bytes in host and portPython Software Foundation · CPython · CVSS 5.3 · 2026-10-29 | 5.3 | 0.3% | 2026-10-29 |
| CVE-2026-4359Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated bufferMongoDB Inc · MongoDB C Driver · CVSS 2 · 2026-03-17 | 2.0 | 0.3% | 2026-03-17 |
| CVE-2026-118767Botan: Python binding bcrypt APIs truncate passwords containing embedded NULsrandombit · botan · CVSS 4.8 · 2026-10-29 | 4.8 | 0.2% | 2026-10-29 |
| CVE-2026-47778Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)envoyproxy · envoy · CVSS 4.4 · 2026-06-26 | 4.4 | 0.2% | 2026-06-26 |
| CVE-2022-31223Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending…Dell · CPG BIOS · CVSS 2.3 · 2022-09-12 | 2.3 | 0.2% | 2022-09-12 |
| CVE-2026-43861mutt before 2.3.2 does not check for '\0' in url_pct_decode.mutt · mutt · CVSS 3.7 · 2026-05-04 | 3.7 | 0.2% | 2026-05-04 |
| CVE-2026-43859mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.mutt · mutt · CVSS 3.7 · 2026-05-04 | 3.7 | 0.2% | 2026-05-04 |
| CVE-2026-41256jq: Embedded NUL truncates top-level jq programs loaded with -fjqlang · jq · CVSS 5.5 · 2026-05-11 | 5.5 | 0.2% | 2026-05-11 |
| CVE-2026-43895jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifactsjqlang · jq · CVSS 4.4 · 2026-05-11 | 4.4 | 0.2% | 2026-05-11 |
| CVE-2026-70603Electron: shell.openPath path validation bypass via embedded null byteelectron · electron · CVSS 6 · 2026-08-05 | 6.0 | 0.1% | 2026-08-05 |
| CVE-2026-92705Aegisub executes arbitrary code through automatically loaded Automation scriptsTypesettingTools · Aegisub · CVSS 7.8 · 2026-10-09 | 7.8 | 0.1% | 2026-10-09 |
| CVE-2025-61985ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.OpenBSD · OpenSSH · CVSS 3.6 · 2025-10-06 | 3.6 | 0.1% | 2025-10-06 |
| CVE-2026-28540Out-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei · HarmonyOS · CVSS 4 · 2026-03-05 | 4.0 | 0.1% | 2026-03-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.