Weaknesses of type CWE-457

293 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.5%CVE-2026-17667MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-17668MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-17714MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.5%CVE-2026-78935CRITICALUse of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute aEPSS 0.5%CVE-2026-14405CRITICALUninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.5%CVE-2026-52931CRITICALbatman-adv: tp_meter: avoid use of uninit sender varsEPSS 0.5%CVE-2026-17077MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.5%CVE-2025-40575MEDIUMA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly valEPSS 0.5%CVE-2026-113030HIGHUse of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sEPSS 0.5%CVE-2023-42062HIGHPDF-XChange Editor U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-19212MEDIUMWonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableEPSS 0.5%CVE-2023-42056LOWPDF-XChange Editor U3D File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-42046LOWPDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-17689MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.5%CVE-2026-15132HIGHUninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.5%CVE-2026-2806CRITICALUninitialized memory in the Graphics: Text componentEPSS 0.4%CVE-2023-39484LOWPDF-XChange Editor PDF File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%