Fallos del tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um ponteiro é declarado mas nunca recebe um endereço de memória válido antes de ser dereferenciado (acessado). O código tenta ler ou escrever em um endereço aleatório da memória, causando comportamento imprevisível: crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um desenvolvedora declara `int *ptr;` em C, depois tenta acessar `*ptr = 42;` sem antes fazer `ptr = malloc(sizeof(int))` ou `ptr = &alguma_variavel;`. O programa escreve em um endereço lixo, quebrando algo na memória ou disparando uma violação de segmentação.

Cómo mitigar

Sempre inicialize ponteiros antes de usar: atribua um endereço válido (alocação dinâmica, referência a variável, ou NULL) no mesmo ponto da declaração. Use ferramentas estáticas (clang-analyzer, valgrind) para detectar casos antes do runtime. Em C++/Rust, prefira smart pointers ou referências, que forçam inicialização.

CVE-2021-3594—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() functioEPSS 0.3%CVE-2021-3592—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() functEPSS 0.3%CVE-2021-3593—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() functiEPSS 0.3%CVE-2022-33280HIGHAccess of uninitialized pointer in Bluetooth HOSTEPSS 0.3%CVE-2021-3595—An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functiEPSS 0.3%CVE-2023-26387MEDIUMZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-26386MEDIUMZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2023-29286MEDIUMZDI-CAN-20369: Adobe Substance 3D Painter USD File Parsing Uninitialized Variable Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-27162HIGHAcrobat Reader | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2024-24925HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized EPSS 0.3%CVE-2026-6751HIGHUninitialized memory in the Audio/Video: Web Codecs componentEPSS 0.3%CVE-2025-66588HIGHAccess of Uninitialized Pointer vulnerability in AzeoTech DAQFactoryEPSS 0.3%CVE-2026-6757MEDIUMInvalid pointer in the JavaScript: WebAssembly componentEPSS 0.3%CVE-2024-21919HIGHRockwell Automation Arena Simulation Vulnerable To Uninitialized PointerEPSS 0.3%CVE-2026-16409HIGHInvalid pointer in the Security: PSM componentEPSS 0.3%CVE-2025-43557HIGHAnimate | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2025-30326HIGHPhotoshop Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2026-39458HIGHBIG-IP DNS Cache vulnerabilityEPSS 0.3%CVE-2026-6778MEDIUMInvalid pointer in the Audio/Video: Playback componentEPSS 0.3%CVE-2022-39147—A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), EPSS 0.3%