Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2025-29830MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.3%CVE-2022-29240HIGHUninitialized memory read in LZ4 decompression leads to authentication bypass in ScyllaEPSS 1.2%CVE-2025-50156MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-53148MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-53138MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-50157MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-53153MEDIUMWindows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityEPSS 1.2%CVE-2024-26220MEDIUMWindows Mobile Hotspot Information Disclosure VulnerabilityEPSS 1.1%CVE-2021-29623LOWUninitialized variable bug in Exiv2EPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2020-35494—There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could caEPSS 1.1%CVE-2023-38140MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-31026MEDIUMUse of Uninitialized Variable in trilogyEPSS 1.1%CVE-2026-57982MEDIUMWindows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityEPSS 1.0%CVE-2026-2044HIGHGIMP PGM File Parsing Uninitialized Memory Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-56190CRITICALRemote Desktop Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-27598HIGHOpenSIPS has vulnerability in the parse_via() functionEPSS 1.0%CVE-2026-50497MEDIUMWindows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-55003MEDIUMWindows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-58535MEDIUMWindows Remote Desktop Client Information Disclosure VulnerabilityEPSS 0.9%