Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2024-50299HIGHsctp: properly validate chunk size in sctp_sf_ootb()EPSS 0.6%CVE-2023-28967HIGHJunos OS and Junos OS Evolved: An attacker sending genuine BGP packets causes an RPD crashEPSS 0.6%CVE-2020-10732LOWA flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a EPSS 0.6%CVE-2025-26803MEDIUMThe http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invaEPSS 0.6%CVE-2024-57802CRITICALnetrom: check buffer length before accessing itEPSS 0.6%CVE-2026-78519HIGHMicrosoft Office Outlook Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-8178CRITICALMultiple issues in ctl(4) CAM Target LayerEPSS 0.6%CVE-2025-2173MEDIUMlibzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointerEPSS 0.6%CVE-2024-7526HIGHANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from mEPSS 0.6%CVE-2026-85880HIGHWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityEPSS 0.6%KEVCVE-2025-33052MEDIUMWindows DWM Core Library Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-21357MEDIUMMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-67648MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-68776MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-42797MEDIUMA vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V0EPSS 0.5%CVE-2020-36617MEDIUMewxrjk sftpserver parse.c sftp_parse_path uninitialized pointerEPSS 0.5%CVE-2026-57083MEDIUMWindows Media Photo Codec Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-55042MEDIUMMicrosoft Office Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-57084MEDIUMWindows File Explorer Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-29829MEDIUMWindows Trusted Runtime Interface Driver Information Disclosure VulnerabilityEPSS 0.5%