Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2018-25014—A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().EPSS 2.2%CVE-2025-62472HIGHWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2024-38064HIGHWindows TCP/IP Information Disclosure VulnerabilityEPSS 2.2%CVE-2026-3497LOWVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by vaEPSS 2.2%CVE-2025-21220HIGHMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 2.2%CVE-2023-36567HIGHWindows Deployment Services Information Disclosure VulnerabilityEPSS 2.0%CVE-2023-36012MEDIUMDHCP Server Service Information Disclosure VulnerabilityEPSS 2.0%CVE-2023-35325HIGHWindows Print Spooler Information Disclosure VulnerabilityEPSS 1.8%CVE-2025-27474MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.8%CVE-2023-38151HIGHMicrosoft Host Integration Server 2020 Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-43458HIGHWindows Networking Information Disclosure VulnerabilityEPSS 1.8%CVE-2023-36913MEDIUMMicrosoft Message Queuing Information Disclosure VulnerabilityEPSS 1.7%CVE-2023-24886HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.6%CVE-2024-38260HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.6%CVE-2020-27795—A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_EPSS 1.5%CVE-2025-29959MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.4%CVE-2023-32042MEDIUMOLE Automation Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-29958MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2025-53719MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-23413HIGHMicrosoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityEPSS 1.3%