Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2026-58051HIGHlibssh2 - Free of Uninitialized Pointer in publickey List CleanupEPSS 0.3%CVE-2026-48101MEDIUMGHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosureEPSS 0.3%CVE-2026-91720MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a cEPSS 0.3%CVE-2024-50143HIGHudf: fix uninit-value use in udf_get_fileshortadEPSS 0.3%CVE-2022-49235MEDIUMath9k_htc: fix uninit value bugsEPSS 0.3%CVE-2026-78984LOWUninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to EPSS 0.3%CVE-2024-50237HIGHwifi: mac80211: do not pass a stopped vif to the driver in .get_txpowerEPSS 0.3%CVE-2026-11809LOWUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataEPSS 0.3%CVE-2026-78914MEDIUMUninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbEPSS 0.3%CVE-2026-79221MEDIUMUninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbEPSS 0.3%CVE-2024-1848HIGHMultiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024EPSS 0.3%CVE-2026-24826CRITICALOut-of-bounds write in turso3dEPSS 0.3%CVE-2022-49298MEDIUMstaging: rtl8712: fix uninit-value in r871xu_drv_init()EPSS 0.3%CVE-2021-34855MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). AEPSS 0.3%CVE-2024-57911HIGHiio: dummy: iio_simply_dummy_buffer: fix information leak in triggered bufferEPSS 0.3%CVE-2024-57912HIGHiio: pressure: zpa2326: fix information leak in triggered bufferEPSS 0.3%CVE-2026-27496HIGHn8n has In-Process Memory Disclosure in its Task RunnerEPSS 0.3%CVE-2022-49301MEDIUMstaging: rtl8712: fix uninit-value in usb_read8() and friendsEPSS 0.3%CVE-2022-49507MEDIUMregulator: da9121: Fix uninit-value in da9121_assign_chip_model()EPSS 0.3%CVE-2020-26266MEDIUMUninitialized memory access in Eigen types in TensorFlowEPSS 0.3%