Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2026-16868HIGHIBM i is Affected By Multiple Vulnerabilities in NetServerEPSS 0.4%CVE-2026-79007LOWUninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to EPSS 0.3%CVE-2026-78986LOWUninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to EPSS 0.3%CVE-2026-68852MEDIUMMicrosoft Account Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-11364HIGHRockwell Automation Third Party Vulnerability in Arena®EPSS 0.3%CVE-2026-68799MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-79120MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data viEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-49165HIGHMicrosoft Windows App Store Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-55198MEDIUMHelm May Panic Due To Incorrect YAML ContentEPSS 0.3%CVE-2024-57997HIGHwifi: wcn36xx: fix channel survey memory allocation sizeEPSS 0.3%CVE-2026-53467MEDIUMImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchangedEPSS 0.3%CVE-2026-16827MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.3%CVE-2026-62377MEDIUMlibheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)EPSS 0.3%CVE-2026-76042LOWUse of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2022-29205MEDIUMSegfault due to missing support for quantized types in TensorFlowEPSS 0.3%CVE-2021-32846HIGHMoby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txEPSS 0.3%CVE-2026-0301LOWPAN-OS: Information Disclosure Vulnerability in URL FilteringEPSS 0.3%CVE-2026-16385HIGHInformation disclosure due to uninitialized memory in the Graphics: WebGPU componentEPSS 0.3%CVE-2026-32814MEDIUMlibheif: Uninitialized Heap Memory Information Leak via Failed Grid TilesEPSS 0.3%