Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2026-62986MEDIUMOpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureEPSS 0.4%CVE-2025-2520HIGHDereferencing of an uninitialized pointer leads to denial of service.EPSS 0.4%CVE-2026-9754HIGHStack memory disclosure in filemd5 commandEPSS 0.4%CVE-2023-25588MEDIUMField `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`EPSS 0.4%CVE-2025-8027MEDIUMJavaScript engine only wrote partial return value to stackEPSS 0.4%CVE-2024-7022HIGHUninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craftEPSS 0.4%CVE-2025-58071HIGHBIG-IP IPSec vulnerabilityEPSS 0.4%CVE-2025-0081HIGHIn dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This couldEPSS 0.4%CVE-2026-55990MEDIUMPacket of death for a DNSCrypt misconfigured UnboundEPSS 0.4%CVE-2026-4147HIGHStack memory disclosure in filemd5 commandEPSS 0.4%CVE-2025-9181MEDIUMUninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2024-45616LOWLibopensc: uninitialized values after incorrect check or usage of apdu response values in libopenscEPSS 0.4%CVE-2024-45615LOWLibopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15initEPSS 0.4%CVE-2025-59348MEDIUMDragonfly incorrectly handles a task structure’s usedTraffic fieldEPSS 0.4%CVE-2022-25737HIGHUse of Uninitialized Variable in MODEMEPSS 0.4%CVE-2021-34953HIGHFoxit PDF Reader Annotation Use of Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-15109MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-17992MEDIUMUninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive inforEPSS 0.3%CVE-2026-17707MEDIUMUninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-17667MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%