Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2025-21996MEDIUMdrm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()EPSS 0.2%CVE-2026-84267MEDIUMGvfs: sftp: uninitialized heap disclosure in read_string()EPSS 0.2%CVE-2022-49845MEDIUMcan: j1939: j1939_send_one(): fix missing CAN header initializationEPSS 0.2%CVE-2025-2329MEDIUMHigh traffic causes corrupt SPI packets in OpenThread leading to denial of serviceEPSS 0.2%CVE-2023-46100MEDIUMCert manager has a use of uninitialized resource vulnerabilityEPSS 0.2%CVE-2025-21843MEDIUMdrm/panthor: avoid garbage value in panthor_ioctl_dev_query()EPSS 0.2%CVE-2025-21716MEDIUMvxlan: Fix uninit-value in vxlan_vnifilter_dump()EPSS 0.2%CVE-2024-57874MEDIUMarm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRLEPSS 0.2%CVE-2026-87497MEDIUMUninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a cEPSS 0.2%CVE-2024-8896HIGHAutodesk AutoCAD DXF File Parsing Unitialized Variable Code Execution VulnerabilityEPSS 0.2%CVE-2022-50374MEDIUMBluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failureEPSS 0.2%CVE-2025-21824MEDIUMgpu: host1x: Fix a use of uninitialized mutexEPSS 0.2%CVE-2023-53341MEDIUMof/fdt: run soc memory setup when early_init_dt_scan_memory failsEPSS 0.2%CVE-2026-54500MEDIUMOj: intern.c form_attr has an uninitialized stack readEPSS 0.2%CVE-2025-40829HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vuEPSS 0.2%CVE-2023-53344MEDIUMcan: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_writeEPSS 0.2%CVE-2021-41225MEDIUMA use of uninitialized value vulnerability in TensorflowEPSS 0.2%CVE-2026-87576LOWUninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2022-49862MEDIUMtipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_headerEPSS 0.2%CVE-2024-57905HIGHiio: adc: ti-ads1119: fix information leak in triggered bufferEPSS 0.2%