Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2024-31636LOWAn issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.EPSS 0.2%CVE-2026-7982MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.2%CVE-2026-7924MEDIUMUninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.2%CVE-2026-9921MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information viEPSS 0.2%CVE-2026-9935MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pEPSS 0.2%CVE-2026-7972MEDIUMUninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak EPSS 0.2%CVE-2026-84391MEDIUMA use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insEPSS 0.2%CVE-2025-7978HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-7981HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-17889MEDIUMUninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.2%CVE-2025-65295HIGHMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 deviEPSS 0.2%CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.2%CVE-2022-2308—A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config spEPSS 0.2%CVE-2026-17858MEDIUMUninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2025-1650HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2025-1649HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2024-10204HIGHHeap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025EPSS 0.2%CVE-2026-21690MEDIUMiccDEV has Type Confusion in CIccTagXmlTagData::ToXml()EPSS 0.2%CVE-2026-26824MEDIUMlibxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the MastEPSS 0.2%CVE-2026-9972HIGHUninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%