Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2026-11057MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-11123MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.3%CVE-2026-11101MEDIUMUninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.3%CVE-2026-11104MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2026-11064MEDIUMRace in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak crEPSS 0.3%CVE-2026-11067MEDIUMUninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-11039MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-11089MEDIUMUninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2026-11137MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.3%CVE-2026-11087MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2026-11268MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-11141MEDIUMUninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2026-11090MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-11110MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2025-1427HIGHCATPRODUCT File Parsing Uninitialized Variable VulnerabilityEPSS 0.2%CVE-2024-47966HIGHUse of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2EPSS 0.2%CVE-2025-26383MEDIUMThe iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the WindowsEPSS 0.2%CVE-2024-31636LOWAn issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.EPSS 0.2%CVE-2026-9942MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to byEPSS 0.2%CVE-2025-7978HIGHAshlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.2%