CWE-252
AllowedUnchecked Return Value
Abstraction: Base · Status: Draft
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
251 vulnerabilities reference this CWE, most recent first.
GHSA-72V7-RM66-2GR3
Vulnerability from github – Published: 2026-05-15 03:30 – Updated: 2026-05-15 03:30An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.
{
"affected": [],
"aliases": [
"CVE-2025-0028"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-15T03:16:21Z",
"severity": "HIGH"
},
"details": "An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.",
"id": "GHSA-72v7-rm66-2gr3",
"modified": "2026-05-15T03:30:37Z",
"published": "2026-05-15T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0028"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4015.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-76PR-H99M-Q4FJ
Vulnerability from github – Published: 2024-05-21 15:31 – Updated: 2025-05-12 21:30In the Linux kernel, the following vulnerability has been resolved:
binder: make sure fd closes complete
During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object cleanup may close 1 or more fds. The close operations are completed using the task work mechanism -- which means the thread needs to return to userspace or the file object may never be dereferenced -- which can lead to hung processes.
Force the binder thread back to userspace if an fd is closed during BC_FREE_BUFFER handling.
{
"affected": [],
"aliases": [
"CVE-2021-47360"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T15:15:22Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: make sure fd closes complete\n\nDuring BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object\ncleanup may close 1 or more fds. The close operations are\ncompleted using the task work mechanism -- which means the thread\nneeds to return to userspace or the file object may never be\ndereferenced -- which can lead to hung processes.\n\nForce the binder thread back to userspace if an fd is closed during\nBC_FREE_BUFFER handling.",
"id": "GHSA-76pr-h99m-q4fj",
"modified": "2025-05-12T21:30:56Z",
"published": "2024-05-21T15:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47360"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5fdb55c1ac9585eb23bb2541d5819224429e103d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aa2c274c279ff365a06a4cba263f04965895166e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b95483d8d94b41fa31a84c1d86710b7907a37621"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d5b0473707fa53b03a5db0256ce62b2874bddbc7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-787R-J94J-7WPV
Vulnerability from github – Published: 2023-03-01 21:30 – Updated: 2025-03-20 15:30In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
{
"affected": [],
"aliases": [
"CVE-2023-23003"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-01T20:15:00Z",
"severity": "HIGH"
},
"details": "In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.",
"id": "GHSA-787r-j94j-7wpv",
"modified": "2025-03-20T15:30:25Z",
"published": "2023-03-01T21:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23003"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/0a515a06c5ebfa46fee3ac519e418f801e718da4"
},
{
"type": "WEB",
"url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230331-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7C4J-2M43-2MGH
Vulnerability from github – Published: 2026-04-22 19:19 – Updated: 2026-04-27 16:22Impact
An untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key.
Hashing an election macro header hashes validators and reaches Validators::voting_keys(), which calls validator.voting_key.uncompress().unwrap() and panics on invalid bytes.
Patches
The patch for this vulnerability is included as part of v1.3.0.
Workarounds
No known workarounds.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "nimiq-primitives"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34065"
],
"database_specific": {
"cwe_ids": [
"CWE-252",
"CWE-755"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-22T19:19:28Z",
"nvd_published_at": "2026-04-22T20:16:41Z",
"severity": "HIGH"
},
"details": "### Impact\nAn untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` set contains an invalid compressed BLS voting key.\n\nHashing an election macro header hashes `validators` and reaches `Validators::voting_keys()`, which calls `validator.voting_key.uncompress().unwrap()` and panics on invalid bytes.\n\n### Patches\n[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff) is included as part of [v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0).\n\n### Workarounds\nNo known workarounds.",
"id": "GHSA-7c4j-2m43-2mgh",
"modified": "2026-04-27T16:22:32Z",
"published": "2026-04-22T19:19:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7c4j-2m43-2mgh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34065"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/pull/3662"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff"
},
{
"type": "PACKAGE",
"url": "https://github.com/nimiq/core-rs-albatross"
},
{
"type": "WEB",
"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals"
}
GHSA-7G6W-JJ32-QJ92
Vulnerability from github – Published: 2026-09-05 06:32 – Updated: 2026-09-05 06:32xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
{
"affected": [],
"aliases": [
"CVE-2026-86141"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-05T05:17:13Z",
"severity": "LOW"
},
"details": "xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.",
"id": "GHSA-7g6w-jj32-qj92",
"modified": "2026-09-05T06:32:37Z",
"published": "2026-09-05T06:32:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86141"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7HM4-28MG-FMP9
Vulnerability from github – Published: 2022-04-21 01:29 – Updated: 2022-04-21 01:29manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.
{
"affected": [],
"aliases": [
"CVE-1999-0199"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-06T13:15:00Z",
"severity": "CRITICAL"
},
"details": "manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree\u0027s root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.",
"id": "GHSA-7hm4-28mg-fmp9",
"modified": "2022-04-21T01:29:06Z",
"published": "2022-04-21T01:29:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0199"
},
{
"type": "WEB",
"url": "https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40"
},
{
"type": "WEB",
"url": "https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz"
},
{
"type": "WEB",
"url": "https://www.cee.studio/tdelete.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7JJW-49WP-PR5H
Vulnerability from github – Published: 2026-09-13 00:31 – Updated: 2026-09-13 00:31wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).
{
"affected": [],
"aliases": [
"CVE-2026-90648"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-13T00:17:07Z",
"severity": "HIGH"
},
"details": "wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a \"table flip\" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table-\u003edata is left NULL while table-\u003esize keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).",
"id": "GHSA-7jjw-49wp-pr5h",
"modified": "2026-09-13T00:31:20Z",
"published": "2026-09-13T00:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90648"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1827704"
},
{
"type": "WEB",
"url": "https://github.com/WebAssembly/wabt"
},
{
"type": "WEB",
"url": "https://github.com/trustsig-eu/wasm2c-tableflip"
},
{
"type": "WEB",
"url": "https://https://blog.mozilla.org/attack-and-defense/2021/12/06/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95"
},
{
"type": "WEB",
"url": "https://rlbox.dev"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7VQ3-23JW-JJMM
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to modify and corrupt the encrypted data.
{
"affected": [],
"aliases": [
"CVE-2020-5359"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to modify and corrupt the encrypted data.",
"id": "GHSA-7vq3-23jw-jjmm",
"modified": "2022-05-24T17:36:43Z",
"published": "2022-05-24T17:36:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5359"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000181098/dsa-2020-114-dell-bsafe-micro-edition-suite-multiple-security-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7WJG-MHWG-M2RC
Vulnerability from github – Published: 2022-04-19 00:00 – Updated: 2025-11-04 00:30A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.
{
"affected": [],
"aliases": [
"CVE-2021-42780"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-18T17:15:00Z",
"severity": "MODERATE"
},
"details": "A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the library.",
"id": "GHSA-7wjg-mhwg-m2rc",
"modified": "2025-11-04T00:30:31Z",
"published": "2022-04-19T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42780"
},
{
"type": "WEB",
"url": "https://github.com/OpenSC/OpenSC/commit/5df913b7"
},
{
"type": "WEB",
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2016139"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202209-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7X65-3XVM-X7WQ
Vulnerability from github – Published: 2023-05-31 15:30 – Updated: 2023-05-31 15:30Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
{
"affected": [],
"aliases": [
"CVE-2023-3013"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T14:15:11Z",
"severity": "MODERATE"
},
"details": "Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.",
"id": "GHSA-7x65-3xvm-x7wq",
"modified": "2023-05-31T15:30:20Z",
"published": "2023-05-31T15:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3013"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/78e539b43293829a14a32e821f5267e3b7417594"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/52f95edc-cc03-4a9f-9bf8-74f641260073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-53
Check the results of all functions that return a value and verify that the value is expected.
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Ensure that you account for all possible return values from the function.
Mitigation
When designing a function, make sure you return a value or throw an exception in case of an error.
No CAPEC attack patterns related to this CWE.