Fallos del tipo CWE-457
246 resultadosUso de variável não inicializada
Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.
Ejemplo
Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.
Cómo mitigar
Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.
CVE-2026-9917MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infEPSS 0.3%CVE-2026-17707MEDIUMUninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-17968MEDIUMUninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-17667MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-15109MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-13943MEDIUMUninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informEPSS 0.3%CVE-2026-17946MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-17759MEDIUMUninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information frEPSS 0.3%CVE-2026-17668MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-14421MEDIUMUninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-14402MEDIUMUninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive infoEPSS 0.3%CVE-2026-14408MEDIUMUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-14399MEDIUMUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2024-1847HIGHMultiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-10994MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information froEPSS 0.3%CVE-2026-10976MEDIUMUninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fromEPSS 0.3%CVE-2026-10977MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leakEPSS 0.3%CVE-2026-13825HIGHUninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a craEPSS 0.3%CVE-2026-5888MEDIUMUninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive informationEPSS 0.3%CVE-2026-14413HIGHUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potEPSS 0.3%