Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2026-2806CRITICALUninitialized memory in the Graphics: Text componentEPSS 0.6%CVE-2026-84639CRITICALUninitialized memory in MIME parsingEPSS 0.6%CVE-2025-20271HIGHCisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service VulnerabilityEPSS 0.5%CVE-2024-29838HIGHUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crashEPSS 0.5%CVE-2025-58466LOWQTS, QuTS heroEPSS 0.5%CVE-2026-14405CRITICALUninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.5%CVE-2026-78935CRITICALUse of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute aEPSS 0.5%CVE-2026-17077MEDIUMIBM i is Affected By Multiple Vulnerabilities in DRDA / DDMEPSS 0.5%CVE-2026-92052HIGHPrivilege escalation due to uninitialized memory in the Graphics: CanvasWebGL componentEPSS 0.5%CVE-2023-42062HIGHPDF-XChange Editor U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-19212MEDIUMWonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableEPSS 0.5%CVE-2026-76919MEDIUMUse of Uninitialized Variable in WiresharkEPSS 0.5%CVE-2023-42056LOWPDF-XChange Editor U3D File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-40575MEDIUMA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly valEPSS 0.5%CVE-2026-6751HIGHUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.5%CVE-2023-42046LOWPDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-26824MEDIUMlibxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the MastEPSS 0.5%CVE-2026-15132HIGHUninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a EPSS 0.5%CVE-2023-42079LOWPDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-42048LOWPDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%