Weaknesses of type CWE-457

293 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2026-43408HIGHceph: add a bunch of missing ceph_path_info initializersEPSS 0.2%CVE-2025-71202HIGHiommu/sva: invalidate stale IOTLB entries for kernel address spaceEPSS 0.2%CVE-2026-92449MEDIUMBinary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arenaEPSS 0.2%CVE-2025-10021HIGHA Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static objectEPSS 0.2%CVE-2025-71130HIGHdrm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbufferEPSS 0.2%CVE-2026-85068LOWNUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msgEPSS 0.2%CVE-2023-31326LOWUse of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driveEPSS 0.1%CVE-2026-23317HIGHdrm/vmwgfx: Return the correct value in vmw_translate_ptr functionsEPSS 0.1%CVE-2026-15168LOWUse of Uninitialized Variable in WiresharkEPSS 0.1%CVE-2025-71096—RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctlyEPSS 0.1%CVE-2026-64413HIGHnetfilter: ebtables: zero chainstack arrayEPSS 0.1%CVE-2026-53374HIGHdrm/amdgpu: zero-initialize GART table on allocationEPSS 0.1%CVE-2026-120243MEDIUMFFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf PaletteEPSS 0.1%CVE-2026-120246MEDIUMFFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM DecoderEPSS 0.1%CVE-2026-64576HIGHnexthop: initialize extack in nh_res_bucket_migrate()EPSS 0.1%CVE-2026-109854LOWM17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decodingEPSS 0.1%CVE-2025-32467MEDIUMUse of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. AuthoEPSS 0.1%CVE-2026-19492LOWThis Power System update is being released to addressEPSS 0.1%CVE-2026-118448MEDIUMUninitialized output buffer returned after nd_to_text failure in pybddisasmEPSS 0.1%CVE-2026-118447MEDIUMUninitialized INSTRUX contents returned after decoding failure in pybddisasmEPSS 0.1%