Weaknesses of type CWE-457

245 results

Uso de variável não inicializada

Ocorre quando o código lê o valor de uma variável antes de atribuir um valor explícito a ela. Dependendo do contexto (memória da stack, heap, ou dados globais), a variável contém lixo de memória, levando a comportamentos impredizíveis: crashes, vazamento de informações ou execução descontrolada.

Example

Um programa aloca um buffer na stack e o passa para uma função sem preenchê-lo antes. Se a função escrever dados sensíveis nesse espaço e depois enviá-lo pela rede, credenciais ou tokens anteriormente na memória podem ser expostos. Ou a leitura do valor lixo causa uma condição de corrida ou salto de endereço inválido.

How to mitigate

Inicialize todas as variáveis no ponto de declaração (int x = 0; char buf[256] = {0};). Use ferramentas de análise estática (cppcheck, clang-tidy) e sanitizers do compilador (-fsanitize=memory no GCC/Clang) para detectar usos antes da inicialização. Em linguagens de nível mais alto, confie no zeroing automático fornecido pelo runtime.

CVE-2026-13969MEDIUMUninitialized Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2026-13030MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.3%CVE-2026-13971MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-13970MEDIUMUninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2024-9717HIGHTrimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2014HIGHAshlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-14418MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-9963HIGHUninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specifiEPSS 0.3%CVE-2026-6311HIGHUninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renEPSS 0.3%CVE-2026-19212MEDIUMWonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableEPSS 0.3%CVE-2026-17968MEDIUMUninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-9917MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2026-17946MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-76919MEDIUMUse of Uninitialized Variable in WiresharkEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-17992MEDIUMUninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.3%CVE-2026-5888MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.3%CVE-2026-55990MEDIUMPacket of death for a DNSCrypt misconfigured UnboundEPSS 0.3%CVE-2026-92052HIGHPrivilege escalation due to uninitialized memory in the Graphics: CanvasWebGL componentEPSS 0.3%CVE-2026-11087MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%