Weaknesses of type CWE-908

345 results

Uso de recurso não inicializado

O código usa uma variável, buffer, ponteiro ou outro recurso sem antes atribuir um valor válido ou preparar adequadamente. Isso leva a comportamento imprevisível: o programa pode ler lixo de memória, crashes, ou em casos críticos, permitir exploração de segurança.

Example

Um desenvolvedor declara um array local de 100 bytes sem inicializar, passa ele para uma função que assume valores válidos, e a função processa lixo de memória como se fossem dados legítimos. Ou um ponteiro não inicializado é desreferenciado, causando acesso a endereço inválido.

How to mitigate

Sempre inicialize variáveis e estruturas no momento da declaração (com valores zero, nulos ou adequados ao contexto). Use ferramentas estáticas (linters, sanitizers) que detectam uso de não-inicializados, e configure o compilador para avisar sobre isso (ex: -Wuninitialized em GCC/Clang).

CVE-2026-69770MEDIUMWindows Spaceport.sys Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-69672MEDIUMWindows DNS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-26175MEDIUMWindows Boot Manager Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-78965MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted EPSS 0.4%CVE-2026-42969MEDIUMWindows Push Notification Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62740MEDIUMWindows Imaging Component Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62709MEDIUMWindows GDI+ Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-59137MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-72945MEDIUMWindows Task Scheduler Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81391MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81958MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-78977MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insEPSS 0.4%CVE-2025-27796MEDIUMReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory iEPSS 0.4%CVE-2024-13164HIGHAn uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a locaEPSS 0.4%CVE-2024-8654MEDIUMMongoDB Server may access non-initialized region of memory leading to unexpected behaviourEPSS 0.4%CVE-2026-59136MEDIUMMicrosoft COM for Windows Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-3862MEDIUMThe MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. ThEPSS 0.4%CVE-2026-70317MEDIUMMicrosoft Office Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-59964HIGHJunos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restartEPSS 0.4%CVE-2024-3299HIGHOut-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the SLDDRW and SLDPRT file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.4%