Cybersecurity glossary
What is a Null Pointer Dereference?
Learn what a null pointer dereference is, why it causes crashes, when it becomes a security issue (DoS or worse), how attackers trigger NULL derefs, and how to prevent unsafe pointer use.
Definition
A null pointer dereference occurs when a program reads or writes memory through a pointer that is NULL (or otherwise invalid at address zero), typically causing a crash and, in some contexts, denial of service or further memory-safety impact.
Why null pointer dereferences matter
A pointer is a contract that memory exists at an address. NULL deliberately means “no object.” Dereferencing it breaks that contract—usually with an immediate crash.
Null Pointer Dereference is sometimes dismissed as “just a bug,” but in network services, kernels, and shared hosts it is a reliable denial-of-service primitive: one crafted request can take down a worker or entire process.
How NULL derefs are triggered
Lookup or allocation fails
A search returns NULL, malloc fails, or an optional object is absent.
Error is ignored
Code assumes success and skips the failure branch or incomplete check.
Pointer is dereferenced
Fields are read or written through the NULL pointer.
Process faults
The OS delivers SIGSEGV/ACCESS_VIOLATION; the worker dies or restarts.
Attacker repeats
On exposed services, repeated crashes become a denial-of-service attack.
Common failure patterns
Missing return checks
Ignoring NULL from malloc, fopen, lookup tables, or factory methods.
Partial NULL guards
Checking pointer on one branch but using it unchecked on another.
Macro-hidden access
Helpers that dereference arguments without documenting NULL requirements.
Check then change
A concurrent path clears the pointer after a NULL check (TOCTOU).
Prevention controls
| Control | Notes |
|---|---|
| Non-nullable types | Use language features that make absence explicit (Option/Maybe/references) |
| Check then use | Handle NULL immediately; do not continue with optimistic assumptions |
| Fail closed | On allocation/lookup failure, return errors instead of proceeding |
| Static analysis | Enable nullability warnings and treat them as defects in CI |
| Fuzz error paths | Force allocation failures and missing-key lookups in tests |
| Service isolation | Crash one worker, not the whole node—still fix the bug |
- Audit APIs that can return NULL and ensure every caller checks.
- Enable compiler nullability annotations where available.
- Add tests for allocation failure and missing-object paths.
- Avoid macros that silently dereference caller pointers.
- Review concurrent code for pointer clear between check and use.
- Monitor production for recurring SIGSEGV stacks on public endpoints.
- Rate-limit and isolate workers to reduce DoS blast radius while fixing.
- Prefer references or non-optional types for values that must exist.
The practical takeaway
A null pointer dereference uses a NULL pointer as if it referenced a real object—usually crashing the process. On attacker-reachable paths, that crash is a security availability issue.
Check every fallible lookup and allocation, and make “object missing” an explicit, tested path—not an assumption.
Related security terms
Uninitialized Memory
Pointers may also be used before initialization, not only when explicitly NULL.
Use-After-Free
Another invalid-pointer class with often higher exploit potential.
Denial of Service (DoS)
Common security impact when NULL derefs crash network-facing services.
Memory Corruption
Broader memory safety failures that include invalid pointer use.
Frequently asked questions
What is a null pointer dereference in simple terms?
The program tries to use a pointer that points to nothing (NULL). Accessing it usually crashes the process with a segmentation fault or access violation.
Is a NULL deref a security vulnerability?
Often yes when an attacker can trigger it in a service—causing denial of service. In rare kernel or special-mapped environments, NULL derefs have been escalated further, but user-space impact is usually crash/DoS.
How is this different from use-after-free?
NULL means the pointer is empty. UAF means the pointer once pointed at valid memory that was freed. UAF more often yields controlled corruption; NULL deref more often yields immediate crashes.
Why do NULL checks fail in practice?
TOCTOU between check and use, checks on one path but not another, macros that hide dereferences, and assumptions that APIs never return NULL.
Do managed languages get NULL derefs?
They get null reference exceptions. Impact is usually contained to the request or process depending on error handling, but uncaught exceptions can still take down services.
How do you prevent them?
Validate pointers before use, prefer non-nullable types, fail closed when allocation or lookup fails, and cover error paths in tests.
Can static analysis find these bugs?
Yes—many analyzers flag paths where a pointer may be NULL at a dereference. Combine with fuzzing for network-facing parsers.
References
Explore authoritative guidance and frameworks related to null pointer dereference.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.