Weaknesses of type CWE-824

208 results

Ponteiro não inicializado

Ocorre quando um ponteiro é usado sem ter recebido um endereço de memória válido antes. O código tenta acessar ou modificar dados através de um ponteiro que aponta para uma posição arbitrária ou lixo de memória, causando comportamento impredizível, corrupção de dados ou crash.

Example

Uma função aloca memória para uma estrutura, mas em um caminho de execução esquece de inicializar um ponteiro dentro dela. Quando outra parte do código tenta usar esse ponteiro, ele aponta para lixo de memória, causando leitura ou escrita em endereços inválidos.

How to mitigate

Sempre inicialize ponteiros explicitamente no ponto de declaração (com NULL ou um endereço válido) e valide antes de usar. Use ferramentas de análise estática (Clang Static Analyzer, Valgrind) e, em linguagens modernas, prefira gerenciamento automático de memória ou smart pointers ao invés de ponteiros brutos.

CVE-2023-44365HIGHZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-32931—An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing projEPSS 2.0%CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2020-16203—Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specEPSS 1.9%CVE-2021-22639—An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a speciEPSS 1.9%CVE-2021-1619CRITICALCisco IOS XE Software NETCONF and RESTCONF Authentication Bypass VulnerabilityEPSS 1.8%CVE-2021-33542HIGHPhoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.8%CVE-2021-43746MEDIUMAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.7%CVE-2018-5392—mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLREPSS 1.4%CVE-2021-31479HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31503HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pEPSS 1.4%CVE-2021-37180—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while EPSS 1.4%CVE-2021-43030LOWAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.3%CVE-2021-22758—A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in losEPSS 1.2%CVE-2018-19018—An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing proEPSS 1.2%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.2%CVE-2021-22670—An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, alEPSS 1.1%CVE-2022-32136MEDIUMCodesys runtime systems: Access of uninitialised pointer lead to denial of service.EPSS 1.0%CVE-2024-26004HIGHPHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX SeriesEPSS 1.0%CVE-2021-33015—Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-EPSS 1.0%