Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2023-34310HIGHAshlar-Vellum Cobalt Uninitialized Memory Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-50188HIGHTrimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-17759MEDIUMUninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.4%CVE-2024-32625MEDIUMUninitialized scalar fieldEPSS 0.4%CVE-2026-6748CRITICALUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.4%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.4%CVE-2024-7868LOWUninitialized variable in Xpdf 4.05 due to invalid JPEG headerEPSS 0.4%CVE-2026-2806CRITICALUninitialized memory in the Graphics: Text componentEPSS 0.4%CVE-2024-37002HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2025-53644MEDIUMOpenCV contains a use after free buffer write due to an uninitialized pointerEPSS 0.4%CVE-2026-19160LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.4%CVE-2026-15770MEDIUMUninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from EPSS 0.4%CVE-2025-64181LOWOpenEXR Makes Use of Uninitialized MemoryEPSS 0.4%CVE-2026-15766MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.4%CVE-2024-8842HIGHPDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-25585MEDIUMField `file_table` of `struct module *module` is uninitializedEPSS 0.4%CVE-2025-8027MEDIUMJavaScript engine only wrote partial return value to stackEPSS 0.4%CVE-2023-25588MEDIUMField `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`EPSS 0.4%CVE-2025-2520HIGHDereferencing of an uninitialized pointer leads to denial of service.EPSS 0.4%CVE-2026-17810MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%