Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2023-3488LOWUninitialized variable in Gecko Bootloader can leak secure stackEPSS 0.3%CVE-2026-78962MEDIUMUninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentialEPSS 0.3%CVE-2026-6686MEDIUMFatFs Use of Uninitialized Clusters After Seek Past EOFEPSS 0.3%CVE-2024-50110MEDIUMxfrm: fix one more kernel-infoleak in algo dumpingEPSS 0.3%CVE-2026-2794MEDIUMInformation disclosure due to uninitialized memory in Firefox and Firefox Focus for AndroidEPSS 0.3%CVE-2026-87642MEDIUMUninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.3%CVE-2026-54634HIGHHamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory DisclosureEPSS 0.3%CVE-2026-11089MEDIUMUninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtEPSS 0.3%CVE-2021-32845HIGHMoby HyperKit uninitialized memory use vtrnd pci_vtrnd_notifyEPSS 0.3%CVE-2026-19448MEDIUMVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.2%CVE-2024-53101MEDIUMfs: Fix uninitialized value issue in from_kuid and from_kgidEPSS 0.2%CVE-2024-56648MEDIUMnet: hsr: avoid potential out-of-bound access in fill_frame_info()EPSS 0.2%CVE-2021-35000LOWOpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure VulnerabilityEPSS 0.2%CVE-2026-91740MEDIUMUninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HEPSS 0.2%CVE-2018-9381HIGHIn gatts_process_read_by_type_req of gatt_sr.c, there is a possible information disclosure due to uninitialized data. This could lead to remEPSS 0.2%CVE-2026-94056HIGHExim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromEPSS 0.2%CVE-2024-11991MEDIUMUninitialized memory access in Motoko incremental garbage collectorEPSS 0.2%CVE-2026-66038HIGHFFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.cEPSS 0.2%CVE-2021-34999LOWOpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure VulnerabilityEPSS 0.2%CVE-2024-57909HIGHiio: light: bh1745: fix information leak in triggered bufferEPSS 0.2%