Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2021-31417MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An EPSS 0.4%CVE-2026-4715CRITICALUninitialized memory in the Graphics: Canvas2D componentEPSS 0.4%CVE-2021-31419MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An EPSS 0.4%CVE-2026-70459MEDIUMrsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List EntryEPSS 0.4%CVE-2026-91946HIGHFreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphicsEPSS 0.4%CVE-2021-3545—An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includiEPSS 0.4%CVE-2026-85089HIGHFreeRDP before 3.31.0 Information Disclosure via uninitialized heap memoryEPSS 0.4%CVE-2026-79285MEDIUMUninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data EPSS 0.4%CVE-2026-79229MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tEPSS 0.4%CVE-2026-79270MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a cEPSS 0.4%CVE-2026-4716CRITICALIncorrect boundary conditions, uninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2026-50690MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-70290MEDIUMWin32k Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-49801MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-40422MEDIUMWindows File Explorer Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-50455MEDIUMUniversal Plug and Play (upnp.dll) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-54997MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-6749HIGHInformation disclosure due to uninitialized memory in the Graphics: Canvas2D componentEPSS 0.4%CVE-2026-66034HIGHlibssh2 Heap Out-of-Bounds Read via publickey subsystemEPSS 0.4%CVE-2026-78969MEDIUMUninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crEPSS 0.4%