Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2025-9450HIGHUse of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2026-13940MEDIUMUninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially senEPSS 0.2%CVE-2022-34390HIGHDell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerabEPSS 0.2%CVE-2026-64699MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,EPSS 0.2%CVE-2026-20051HIGHCisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service VulnerabilityEPSS 0.2%CVE-2026-65405MEDIUMA memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOEPSS 0.2%CVE-2025-6974HIGHUse of Uninitialized Variable vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025EPSS 0.2%CVE-2025-10021HIGHA Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static objectEPSS 0.2%CVE-2025-29952MEDIUMImproper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP EPSS 0.1%CVE-2023-31326LOWUse of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driveEPSS 0.1%CVE-2026-47336LOWUse of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rulesEPSS 0.1%CVE-2026-47330LOWUse of uninitialized value in Ubuntu Linux AppArmor notification handlingEPSS 0.1%CVE-2026-15168LOWUse of Uninitialized Variable in WiresharkEPSS 0.1%CVE-2024-33021HIGHUse of Uninitialized Variable in Automotive GPUEPSS 0.1%CVE-2025-32467MEDIUMUse of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. AuthoEPSS 0.1%CVE-2025-20638MEDIUMIn DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if anEPSS 0.1%CVE-2026-58731MEDIUMIn multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local EPSS 0.1%CVE-2022-33716LOWAn absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.EPSS 0.1%CVE-2026-58721MEDIUMIn multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information discEPSS 0.1%CVE-2025-26448MEDIUMIn writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local informationEPSS 0.1%