Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2021-34951LOWFoxit PDF Reader Annotation Use of Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-19161LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2024-23159HIGHMultiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsEPSS 0.3%CVE-2024-45618LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15initEPSS 0.3%CVE-2026-13950MEDIUMUninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaiEPSS 0.3%CVE-2026-13947MEDIUMUninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtainEPSS 0.3%CVE-2026-13833MEDIUMUninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.3%CVE-2026-6751HIGHUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.3%CVE-2024-45617LOWLibopensc: uninitialized values after incorrect or missing checking return values of functions in libopenscEPSS 0.3%CVE-2025-2287HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-2286HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2025-2285HIGHLocal Code Execution Vulnerability in Arena®EPSS 0.3%CVE-2026-84564MEDIUMAn uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 andEPSS 0.3%CVE-2024-9355MEDIUMGolang-fips: golang fips zeroed bufferEPSS 0.3%CVE-2024-7541LOWoFono AT CMT Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-7542LOWoFono AT CMGR Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-7540LOWoFono AT CMGL Command Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-31874MEDIUMIBM Security Verify Access Appliance denial of serviceEPSS 0.3%CVE-2026-10960HIGHUninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poEPSS 0.3%CVE-2026-13023MEDIUMUninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%