CWE-170Improper Null Termination

Abstraction: Base · CVEs in our corpus: 45

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (0)AI

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-11045`	3.2	3.7	0.4148	2019-12-23
`CVE-2019-8275`	2.2	9.8	0.0433	2019-03-08
`CVE-2021-31886`	2.2	9.8	0.0343	2021-11-09
`CVE-2021-1469`	2.0	9.9	0.0037	2021-03-24
`CVE-2021-1471`	2.0	9.9	0.0030	2021-03-24
`CVE-2021-1411`	2.0	9.9	0.0046	2021-03-24
`CVE-2021-1417`	2.0	9.9	0.0033	2021-03-24
`CVE-2021-1418`	2.0	9.9	0.0050	2021-03-24
`CVE-2021-22931`	2.0	9.8	0.0066	2021-08-16
`CVE-2021-31884`	2.0	9.8	0.0073	2021-11-09
`CVE-2021-31887`	2.0	8.8	0.0340	2021-11-09
`CVE-2021-31888`	2.0	8.8	0.0340	2021-11-09
`CVE-2024-43474`	1.9	7.6	0.0673	2024-09-10
`CVE-2026-34464`	1.8	8.8	0.0001	2026-05-05
`CVE-2024-45288`	1.7	8.4	0.0007	2024-09-05
`CVE-2024-21442`	1.6	7.8	0.0043	2024-03-12
`CVE-2024-31484`	1.6	7.8	0.0006	2024-05-14
`CVE-2026-34462`	1.6	7.8	0.0001	2026-05-05
`CVE-2022-47515`	1.5	7.5	0.0067	2022-12-18
`CVE-2023-24021`	1.5	7.5	0.0010	2023-01-20
`CVE-2023-35321`	1.5	6.5	0.0344	2023-07-11
`CVE-2025-62792`	1.5	7.5	0.0006	2025-10-29
`CVE-2025-67790`	1.5	7.5	0.0009	2025-12-17
`CVE-2021-1120`	1.4	7.0	0.0005	2021-10-29
`CVE-2023-48674`	1.4	6.8	0.0013	2024-03-01