Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2026-17810MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17790MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.4%CVE-2026-17785MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.4%CVE-2026-17757MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17771MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.4%CVE-2026-17740MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.4%CVE-2024-7022HIGHUninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craftEPSS 0.4%CVE-2025-58071HIGHBIG-IP IPSec vulnerabilityEPSS 0.4%CVE-2025-0081HIGHIn dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This couldEPSS 0.4%CVE-2025-9181MEDIUMUninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2026-34608MEDIUMnanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB ReadEPSS 0.4%CVE-2024-45616LOWLibopensc: uninitialized values after incorrect check or usage of apdu response values in libopenscEPSS 0.4%CVE-2024-45615LOWLibopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15initEPSS 0.4%CVE-2025-59348MEDIUMDragonfly incorrectly handles a task structure’s usedTraffic fieldEPSS 0.4%CVE-2026-17077MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.4%CVE-2022-25737HIGHUse of Uninitialized Variable in MODEMEPSS 0.4%CVE-2021-34953HIGHFoxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-19146MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2026-15109MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-14421MEDIUMUninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%