Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2025-13763MEDIUMLibopensc: opensc: multiple uses of uninitialized variableEPSS 0.2%CVE-2025-9450HIGHUse of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2026-13940MEDIUMUninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially senEPSS 0.2%CVE-2022-34390HIGHDell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerabEPSS 0.2%CVE-2026-65405MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOEPSS 0.2%CVE-2025-6974HIGHUse of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2026-20051HIGHCisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service VulnerabilityEPSS 0.2%CVE-2025-10021HIGHA Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static objectEPSS 0.2%CVE-2025-29952MEDIUMImproper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP EPSS 0.1%CVE-2023-31326LOWUse of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driveEPSS 0.1%CVE-2026-15168LOWUse of Uninitialized Variable in WiresharkEPSS 0.1%CVE-2024-33021HIGHUse of Uninitialized Variable in Automotive GPUEPSS 0.1%CVE-2025-32467MEDIUMUse of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. AuthoEPSS 0.1%CVE-2025-20638MEDIUMIn DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if anEPSS 0.1%CVE-2022-33716LOWAn absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.EPSS 0.1%CVE-2026-47336LOWUse of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rulesEPSS 0.1%CVE-2026-47330LOWUse of uninitialized value in Ubuntu Linux AppArmor notification handlingEPSS 0.1%CVE-2025-26448MEDIUMIn writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local informationEPSS 0.1%CVE-2025-20771MEDIUMIn display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege iEPSS 0.1%CVE-2025-20784MEDIUMIn display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a maliciousEPSS 0.1%