CWE-158

37 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 6High 11Medium 14Low 6Not scored 0

CVEs per yearBy the year they were published

CVE-2009-1537
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows…
Product not named
ExploitedHigh8.8
CVE-2025-47812
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session…
wftpserver · Wing FTP Server
ExploitedCritical10.0

CVE-2026-115473
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
cesanta · mongoose
Medium6.5
CVE-2026-105475
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
WebPros · cPanel
High8.7
CVE-2026-116566
socket.getaddrinfo() accepts embedded null bytes in host and port
Python Software Foundation · CPython
Medium5.3
CVE-2026-118767
Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs
randombit · botan
Medium4.8
CVE-2026-84790
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
OpenVPN · OpenVPN
High7.6
CVE-2026-92705
Aegisub executes arbitrary code through automatically loaded Automation scripts
TypesettingTools · Aegisub
High7.8
CVE-2026-105240
Apache log4net: NUL character truncates OutputDebugStringAppender records
Apache Software Foundation · Apache log4net
Medium5.3
CVE-2026-105239
Apache log4net: NUL character truncates EventLogAppender records
Apache Software Foundation · Apache log4net
Medium5.3
CVE-2026-76354
Path Traversal through Search Head Clustering in Splunk Enterprise
Splunk · Splunk Enterprise
High8.1
CVE-2026-70603
Electron: shell.openPath path validation bypass via embedded null byte
electron · electron
Medium6.0