Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2023-3488LOWUninitialized variable in Gecko Bootloader can leak secure stackEPSS 0.3%CVE-2026-78962MEDIUMUninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentialEPSS 0.3%CVE-2026-6686MEDIUMFatFs Use of Uninitialized Clusters After Seek Past EOFEPSS 0.3%CVE-2024-50110MEDIUMxfrm: fix one more kernel-infoleak in algo dumpingEPSS 0.3%CVE-2026-2794MEDIUMInformation disclosure due to uninitialized memory in Firefox and Firefox Focus for AndroidEPSS 0.3%CVE-2026-87642MEDIUMUninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.3%CVE-2026-54634HIGHHamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory DisclosureEPSS 0.3%CVE-2026-11089MEDIUMUninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2021-32845HIGHMoby HyperKit uninitialized memory use vtrnd pci_vtrnd_notifyEPSS 0.3%CVE-2026-19448MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2024-53101MEDIUMfs: Fix uninitialized value issue in from_kuid and from_kgidEPSS 0.2%CVE-2024-56648MEDIUMnet: hsr: avoid potential out-of-bound access in fill_frame_info()EPSS 0.2%CVE-2021-35000LOWOpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-91740MEDIUMUninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HEPSS 0.2%CVE-2018-9381HIGHIn gatts_process_read_by_type_req of gatt_sr.c, there is a possible information disclosure due to uninitialized data. This could lead to remEPSS 0.2%CVE-2026-94056HIGHExim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromEPSS 0.2%CVE-2024-11991MEDIUMUninitialized memory access in Motoko incremental garbage collectorEPSS 0.2%CVE-2026-66038HIGHFFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.cEPSS 0.2%CVE-2021-34999LOWOpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure VulnerabilityEPSS 0.2%CVE-2024-57909HIGHiio: light: bh1745: fix information leak in triggered bufferEPSS 0.2%