CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
96 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-11972 — tarfile opened in streaming mode mishandles EOF
- CVE-2025-66565 — Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
- CVE-2026-22861 — iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp
- CVE-2026-22255 — iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp
- CVE-2026-22047 — iccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp
- CVE-2026-22046 — iccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp
- CVE-2026-21920 — Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash
- CVE-2025-61935 — BIG-IP Advanced WAF and ASM vulnerability
- CVE-2026-31830 — sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
- CVE-2026-0723 — Unchecked Return Value in GitLab
- CVE-2026-40060 — BIG-IP Advanced WAF and ASM vulnerability
- CVE-2024-39558 — Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR
- CVE-2026-0421 — A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads wh
- CVE-2025-0028 — An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify
- CVE-2025-62791 — Wazuh vulnerable to NULL pointer dereference in DecodeCiscat
- CVE-2025-62790 — Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state
- CVE-2025-62789 — Wazuh vulnerable to NULL pointer dereference in fim_alert line 712
- CVE-2025-62785 — Wazuh fillData NULL pointer dereference causes analysisd crash
- CVE-2025-54571 — ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A
Recently published
- CVE-2026-86749 — snipe-it before 8.7.0 Data Loss via Failed Image Write
- CVE-2026-86739 — Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- CVE-2026-86141 — xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., i
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the A
- CVE-2026-14957 — FIPS mode assertion failure via malicious CERT payload
- CVE-2026-78699 — rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-79772 — Nokogiri before 1.19.1 Unchecked Return Value canonicalize
- CVE-2026-77641 — tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of re
- CVE-2026-47245 — MyBB: Buddy list corruption
- CVE-2026-26080 — HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAPro
- CVE-2026-61857 — ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
- CVE-2026-11972 — tarfile opened in streaming mode mishandles EOF
- CVE-2026-40092 — nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT
- CVE-2025-29938 — An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbi
- CVE-2025-0028 — An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify
- CVE-2026-40060 — BIG-IP Advanced WAF and ASM vulnerability
- CVE-2026-20793 — Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applic
- CVE-2026-34065 — nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
- CVE-2026-35344 — uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
More specific weaknesses
- CWE-690 — Unchecked Return Value to NULL Pointer Dereference