Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2025-39904MEDIUMarm64: kexec: initialize kexec_buf struct in load_other_segments()EPSS 0.1%CVE-2026-70629MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC DecoderEPSS 0.1%CVE-2026-70630MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso DecoderEPSS 0.1%CVE-2026-63381MEDIUMLibevent: Dangling Pointer in `evbuffer_add_buffer_reference`EPSS 0.1%CVE-2026-47272HIGHpam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG bufferEPSS 0.1%CVE-2026-49425MEDIUMKernel stack disclosure in 32-bit compatibility supportEPSS 0.1%CVE-2026-49424MEDIUMKernel stack disclosure in Linux compatibility layerEPSS 0.1%CVE-2024-36503HIGHMemory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-58084MEDIUMKernel stack disclosure via timer_settime(2)EPSS 0.1%CVE-2026-6368LOWwordexp with WRDE_APPEND can return or use invalid memoryEPSS 0.1%CVE-2025-12474LOWlibjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handlingEPSS 0.1%CVE-2025-48513MEDIUMUse of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memoEPSS 0.1%CVE-2026-49423LOWRemote DOS via uninitialized memory access in KTLS receiveEPSS 0.1%CVE-2026-15710MEDIUMNetskope Client Endpoint DLP Kernel Driver Information LeakageEPSS 0.1%CVE-2026-68744LOWSssd: sssd: nss responder uninitialized heap disclosure in initgroups replyEPSS 0.1%CVE-2018-9377HIGHIn getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent. This coEPSS 0.1%CVE-2018-9378MEDIUMIn BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This cEPSS 0.1%CVE-2018-9346MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2018-9345MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2024-29785MEDIUMIn aur_get_state of aurora.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disEPSS 0.1%