Fallos del tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um ponteiro é declarado mas nunca recebe um endereço de memória válido antes de ser dereferenciado (acessado). O código tenta ler ou escrever em um endereço aleatório da memória, causando comportamento imprevisível: crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um desenvolvedora declara `int *ptr;` em C, depois tenta acessar `*ptr = 42;` sem antes fazer `ptr = malloc(sizeof(int))` ou `ptr = &alguma_variavel;`. O programa escreve em um endereço lixo, quebrando algo na memória ou disparando uma violação de segmentação.

Cómo mitigar

Sempre inicialize ponteiros antes de usar: atribua um endereço válido (alocação dinâmica, referência a variável, ou NULL) no mesmo ponto da declaração. Use ferramentas estáticas (clang-analyzer, valgrind) para detectar casos antes do runtime. Em C++/Rust, prefira smart pointers ou referências, que forçam inicialização.

CVE-2023-44365HIGHZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-32931—An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing projEPSS 2.0%CVE-2021-29098HIGHArcGIS general raster security update: uninitialized pointerEPSS 2.0%CVE-2020-16203—Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specEPSS 1.9%CVE-2021-22639—An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a speciEPSS 1.9%CVE-2021-1619CRITICALCisco IOS XE Software NETCONF and RESTCONF Authentication Bypass VulnerabilityEPSS 1.8%CVE-2021-33542HIGHPhoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerabilityEPSS 1.8%CVE-2021-43746MEDIUMAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.7%CVE-2018-5392—mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLREPSS 1.4%CVE-2021-31479HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User inEPSS 1.4%CVE-2021-31503HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pEPSS 1.4%CVE-2021-37180—A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while EPSS 1.4%CVE-2021-43030LOWAdobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 1.3%CVE-2021-22758—A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in losEPSS 1.2%CVE-2018-19018—An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing proEPSS 1.2%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.2%CVE-2021-22670—An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, alEPSS 1.1%CVE-2022-32136MEDIUMCodesys runtime systems: Access of uninitialised pointer lead to denial of service.EPSS 1.0%CVE-2024-26004HIGHPHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX SeriesEPSS 1.0%CVE-2021-33015—Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-EPSS 1.0%