Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2026-16386HIGHInformation disclosure due to uninitialized memory in the Graphics: WebGPU componentEPSS 0.3%CVE-2026-16385HIGHInformation disclosure due to uninitialized memory in the Graphics: WebGPU componentEPSS 0.3%CVE-2026-79040MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sanEPSS 0.3%CVE-2026-87555MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sanEPSS 0.3%CVE-2026-79269MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy viEPSS 0.3%CVE-2026-84326HIGHUninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox EPSS 0.3%CVE-2022-2950HIGH Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of EPSS 0.3%CVE-2026-54604MEDIUMOpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1EPSS 0.3%CVE-2026-69288MEDIUMWindows GDI+ Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-69853MEDIUMWin32k Information Disclosure VulnerabilityEPSS 0.3%CVE-2022-49326MEDIUMrtl818x: Prevent using not initialized queuesEPSS 0.3%CVE-2022-0433—A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of thEPSS 0.3%CVE-2024-50273HIGHbtrfs: reinitialize delayed ref list after deleting it from the listEPSS 0.3%CVE-2026-7141MEDIUMvLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resourceEPSS 0.3%CVE-2026-78958LOWUninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process toEPSS 0.3%CVE-2025-27810MEDIUMMbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory EPSS 0.3%CVE-2022-2949HIGH Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of EPSS 0.3%CVE-2022-49374MEDIUMtipc: check attribute length for bearer nameEPSS 0.3%CVE-2026-48101MEDIUMGHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosureEPSS 0.3%CVE-2026-91720MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a cEPSS 0.3%