Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2024-53155HIGHocfs2: fix uninitialized value in ocfs2_file_read_iter()EPSS 0.2%CVE-2025-31649HIGHDell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerabilityEPSS 0.2%CVE-2026-87456LOWUninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tEPSS 0.2%CVE-2025-21862MEDIUMdrop_monitor: fix incorrect initialization orderEPSS 0.2%CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.2%CVE-2024-56739MEDIUMrtc: check if __rtc_read_time was successful in rtc_timer_do_work()EPSS 0.2%CVE-2024-27431HIGHcpumap: Zero-initialise xdp_rxq_info struct before running XDP programEPSS 0.2%CVE-2024-32606MEDIUMHDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5EPSS 0.2%CVE-2024-50173HIGHdrm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()EPSS 0.2%CVE-2024-50300HIGHregulator: rtq2208: Fix uninitialized use of regulator_configEPSS 0.2%CVE-2025-21922MEDIUMppp: Fix KMSAN uninit-value warning with bpfEPSS 0.2%CVE-2025-31361HIGHDell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerabilityEPSS 0.2%CVE-2024-57906HIGHiio: adc: ti-ads8688: fix information leak in triggered bufferEPSS 0.2%CVE-2024-53083MEDIUMusb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlierEPSS 0.2%CVE-2024-57908HIGHiio: imu: kmx61: fix information leak in triggered bufferEPSS 0.2%CVE-2024-57910HIGHiio: light: vcnl4035: fix information leak in triggered bufferEPSS 0.2%CVE-2021-3435MEDIUML2CAP: Information leakage in le_ecred_conn_req()EPSS 0.2%CVE-2026-58247MEDIUMMemory Corruption vulnerability in SAP ABAP PlatformEPSS 0.2%CVE-2024-57907HIGHiio: adc: rockchip_saradc: fix information leak in triggered bufferEPSS 0.2%CVE-2026-26825MEDIUMA use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorEPSS 0.2%