Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2026-10008MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.2%CVE-2026-9754HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-16417LOWUninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.2%CVE-2026-11159MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.2%CVE-2026-17949MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.2%CVE-2025-7984HIGHAshlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-4147HIGHStack memory disclosure in filemd5 commandEPSS 0.2%CVE-2026-9920LOWUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2025-5749MEDIUMWOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass VulnerabilityEPSS 0.2%CVE-2024-56446MEDIUMVulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affectEPSS 0.2%CVE-2026-8020MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-64699MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,EPSS 0.2%CVE-2026-22188MEDIUMPanda3D <= 1.10.16 Deploy-Stub Stack Exhaustion via Unbounded alloca()EPSS 0.2%CVE-2026-1333HIGHUse of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026EPSS 0.2%CVE-2026-9942MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to byEPSS 0.2%CVE-2026-9944LOWUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leEPSS 0.2%CVE-2026-11668MEDIUMUninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data EPSS 0.2%CVE-2026-11696MEDIUMUninitialized Use in Video in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-12469MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.2%CVE-2025-5047HIGHDGN File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%