Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2025-2024HIGHTrimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-39484LOWPDF-XChange Editor PDF File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-10934CRITICALOpenBSD NFS double-free vulnerabilityEPSS 0.4%CVE-2022-40510CRITICALBuffer copy without checking size of input in Audio.EPSS 0.4%CVE-2023-38088HIGHKofax Power PDF printf Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-34310HIGHAshlar-Vellum Cobalt Uninitialized Memory Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-50188HIGHTrimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-32625MEDIUMUninitialized scalar fieldEPSS 0.4%CVE-2026-84391MEDIUMA use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insEPSS 0.4%CVE-2026-9963HIGHUninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specifiEPSS 0.4%CVE-2026-16141HIGHOpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge ValueEPSS 0.4%CVE-2024-7868LOWUninitialized variable in Xpdf 4.05 due to invalid JPEG headerEPSS 0.4%CVE-2024-37002HIGHMultiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareEPSS 0.4%CVE-2025-53644MEDIUMOpenCV contains a use after free buffer write due to an uninitialized pointerEPSS 0.4%CVE-2026-84564MEDIUMAn uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 andEPSS 0.4%CVE-2026-15770MEDIUMUninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from EPSS 0.4%CVE-2025-64181LOWOpenEXR Makes Use of Uninitialized MemoryEPSS 0.4%CVE-2026-15766MEDIUMUninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.4%CVE-2024-8842HIGHPDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.4%