Fallos del tipo CWE-665

153 resultados

Inicialização incorreta ou ausente de recursos

Ocorre quando um recurso (variável, buffer, conexão, arquivo) não é inicializado ou é inicializado de forma incompleta antes do uso, deixando-o em estado indeterminado. Isso pode levar a comportamentos imprevisíveis, vazamento de dados sensíveis ou crashes, pois o código tenta usar valores aleatórios ou valores de memória anterior.

Ejemplo

Um desenvolvedor declara um buffer para armazenar credenciais, mas esquece de zerar sua memória antes de preenchê-lo; se o código ler dessa memória antes de atribuir um valor válido, pode expor dados de sessões anteriores. Ou uma variável booleana que controla acesso é usada sem ser definida, assumindo um valor aleatório de memória.

Cómo mitigar

Sempre inicialize explicitamente recursos no ponto de declaração ou antes do primeiro uso: atribua valores padrão seguros, use construtores ou funções de setup específicas. Ferramentas de análise estática (lint, SAST) e testes com sanitizers de memória ajudam a detectar usos sem inicialização.

CVE-2026-54409HIGHA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnEPSS 0.4%CVE-2026-57229MEDIUMSuricata smtp/mime: incomplete state reset allows detection bypassEPSS 0.4%CVE-2023-28720MEDIUMImproper initialization for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthenEPSS 0.4%CVE-2021-20317—A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timeEPSS 0.4%CVE-2023-1047MEDIUMTechPowerUp RealTemp WinRing0x64.sys initializationEPSS 0.4%CVE-2023-35061LOWImproper initialization for the Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthentEPSS 0.4%CVE-2020-14347MEDIUMA flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases whEPSS 0.4%CVE-2026-87616HIGHImproper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renEPSS 0.4%CVE-2018-1118LOWLinux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating syEPSS 0.4%CVE-2026-26958LOWfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identityEPSS 0.4%CVE-2026-78940MEDIUMImproper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.4%CVE-2023-27322HIGHParallels Desktop Service Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27324HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-55118HIGHBMC Control-M/Agent memory corruption in SSL/TLS communicationEPSS 0.4%CVE-2023-40261MEDIUMDiebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file atEPSS 0.4%CVE-2023-27325HIGHParallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-26084LOWThe armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataEPSS 0.4%CVE-2021-0145MEDIUMImproper initialization of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information diEPSS 0.3%CVE-2023-27115—WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.EPSS 0.3%CVE-2026-12233MEDIUMUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionEPSS 0.3%