Fallos del tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um ponteiro é declarado mas nunca recebe um endereço de memória válido antes de ser dereferenciado (acessado). O código tenta ler ou escrever em um endereço aleatório da memória, causando comportamento imprevisível: crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um desenvolvedora declara `int *ptr;` em C, depois tenta acessar `*ptr = 42;` sem antes fazer `ptr = malloc(sizeof(int))` ou `ptr = &alguma_variavel;`. O programa escreve em um endereço lixo, quebrando algo na memória ou disparando uma violação de segmentação.

Cómo mitigar

Sempre inicialize ponteiros antes de usar: atribua um endereço válido (alocação dinâmica, referência a variável, ou NULL) no mesmo ponto da declaração. Use ferramentas estáticas (clang-analyzer, valgrind) para detectar casos antes do runtime. Em C++/Rust, prefira smart pointers ou referências, que forçam inicialização.

CVE-2021-38409HIGHFuji Electric Tellus Lite V-Simulator uninitialized pointerEPSS 0.7%CVE-2022-22236HIGHJunos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crashEPSS 0.7%CVE-2022-40649HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40645HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40643HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40646HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2022-40642HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interactionEPSS 0.6%CVE-2025-2173MEDIUMlibzvbi conv.c vbi_strndup_iconv_ucs2 uninitialized pointerEPSS 0.6%CVE-2024-33608HIGHBIG-IP IPsec vulnerabilityEPSS 0.6%CVE-2025-32451HIGHA memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. A specially crafted JavaEPSS 0.6%CVE-2022-34480HIGHWithin the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freeEPSS 0.5%CVE-2022-43609HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of IronCAD. User interaction is required to eEPSS 0.5%CVE-2022-38427HIGHAdobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%CVE-2022-38426HIGHAdobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-16353CRITICALInvalid pointer in the DOM: Bindings (WebIDL) componentEPSS 0.5%CVE-2026-67281HIGHUnauthenticated file read in Mikrotik RouterOSEPSS 0.4%CVE-2025-27158HIGHAcrobat Reader | Access of Uninitialized Pointer (CWE-824)EPSS 0.4%CVE-2021-0209MEDIUMJunos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.EPSS 0.4%CVE-2022-1016—A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to hEPSS 0.4%CVE-2024-45155HIGHAnimate | Access of Uninitialized Pointer (CWE-824)EPSS 0.4%