Fallos del tipo CWE-824

208 resultados

Ponteiro não inicializado

Ocorre quando um ponteiro é declarado mas nunca recebe um endereço de memória válido antes de ser dereferenciado (acessado). O código tenta ler ou escrever em um endereço aleatório da memória, causando comportamento imprevisível: crash, corrupção de dados ou execução de código arbitrário.

Ejemplo

Um desenvolvedora declara `int *ptr;` em C, depois tenta acessar `*ptr = 42;` sem antes fazer `ptr = malloc(sizeof(int))` ou `ptr = &alguma_variavel;`. O programa escreve em um endereço lixo, quebrando algo na memória ou disparando uma violação de segmentação.

Cómo mitigar

Sempre inicialize ponteiros antes de usar: atribua um endereço válido (alocação dinâmica, referência a variável, ou NULL) no mesmo ponto da declaração. Use ferramentas estáticas (clang-analyzer, valgrind) para detectar casos antes do runtime. Em C++/Rust, prefira smart pointers ou referências, que forçam inicialização.

CVE-2022-39146—A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), EPSS 0.3%CVE-2025-54207HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.3%CVE-2021-41201HIGHUnitialized access in `EinsumHelper::ParseEquation`EPSS 0.2%CVE-2023-27858HIGHRockwell Automation Arena® Simulation Uninitialized Pointer VulnerabilityEPSS 0.2%CVE-2022-3377HIGHHorner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FEPSS 0.2%CVE-2022-3378HIGH Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed EPSS 0.2%CVE-2026-21276HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2026-21275HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2025-2530HIGHLuxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.2%CVE-2022-31599HIGHNVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialiEPSS 0.2%CVE-2022-41851HIGHA vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap EPSS 0.2%CVE-2022-2952HIGHGE CIMPLICITY Access of Uninitialized PointerEPSS 0.2%CVE-2022-3084HIGHGE CIMPLICITY Access of Uninitialized PointerEPSS 0.2%CVE-2023-31244HIGH The affected product does not properly validate user-supplied data. If a user opens a maliciously formed CSP file, then aEPSS 0.2%CVE-2022-21156MEDIUMAccess of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentEPSS 0.2%CVE-2023-24978HIGHA vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to unEPSS 0.2%CVE-2023-25007HIGHA malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execEPSS 0.2%CVE-2025-9274HIGHOxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-49529HIGHIllustrator | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%CVE-2025-43592HIGHInDesign Desktop | Access of Uninitialized Pointer (CWE-824)EPSS 0.2%