Fallos del tipo CWE-457

246 resultados

Uso de variável não inicializada

Ocorre quando o código usa uma variável antes de atribuir um valor válido a ela. A variável contém lixo de memória (valores aleatórios deixados por operações anteriores), levando a comportamento imprevisível: falhas, execução de código não intencional ou exposição de dados sensíveis.

Ejemplo

Um programa lê um arquivo de configuração em uma variável sem garantir que ela foi preenchida antes de usá-la em uma operação crítica. Se a leitura falhar silenciosamente, a variável mantém seu conteúdo anterior (senha de outro processo, por exemplo) e é transmitida para um servidor remoto.

Cómo mitigar

Sempre inicialize variáveis com valores seguros (zero, null ou constante adequada) no ponto de declaração. Use análise estática (linters, compiladores com flags como -Wall -Wuninitialized em C/C++) para detectar essas falhas antes da compilação.

CVE-2026-17808MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-17740MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-17757MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-17689MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-7972MEDIUMUninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak EPSS 0.3%CVE-2026-14418MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2026-17949MEDIUMUninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteEPSS 0.3%CVE-2026-9935MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pEPSS 0.3%CVE-2026-9921MEDIUMUninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information viEPSS 0.3%CVE-2026-17858MEDIUMUninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.3%CVE-2026-17810MEDIUMUninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-17771MEDIUMUninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-17785MEDIUMUninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-16417LOWUninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2026-19160LOWUninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leaEPSS 0.3%CVE-2026-9920LOWUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2026-11089MEDIUMUninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2026-11057MEDIUMUninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtaEPSS 0.3%CVE-2026-11064MEDIUMRace in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak crEPSS 0.3%