Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2025-39904MEDIUMarm64: kexec: initialize kexec_buf struct in load_other_segments()EPSS 0.1%CVE-2026-70629MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC DecoderEPSS 0.1%CVE-2026-70630MEDIUMFFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso DecoderEPSS 0.1%CVE-2026-63381MEDIUMLibevent: Dangling Pointer in `evbuffer_add_buffer_reference`EPSS 0.1%CVE-2026-47272HIGHpam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG bufferEPSS 0.1%CVE-2026-49425MEDIUMKernel stack disclosure in 32-bit compatibility supportEPSS 0.1%CVE-2026-49424MEDIUMKernel stack disclosure in Linux compatibility layerEPSS 0.1%CVE-2024-36503HIGHMemory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-58084MEDIUMKernel stack disclosure via timer_settime(2)EPSS 0.1%CVE-2026-6368LOWwordexp with WRDE_APPEND can return or use invalid memoryEPSS 0.1%CVE-2025-12474LOWlibjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handlingEPSS 0.1%CVE-2026-49423LOWRemote DOS via uninitialized memory access in KTLS receiveEPSS 0.1%CVE-2026-15710MEDIUMNetskope Client Endpoint DLP Kernel Driver Information LeakageEPSS 0.1%CVE-2025-48513MEDIUMUse of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memoEPSS 0.1%CVE-2026-68744LOWSssd: sssd: nss responder uninitialized heap disclosure in initgroups replyEPSS 0.1%CVE-2018-9377HIGHIn getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent. This coEPSS 0.1%CVE-2018-9378MEDIUMIn BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This cEPSS 0.1%CVE-2018-9346MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2018-9345MEDIUMIn BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This coEPSS 0.1%CVE-2024-29780MEDIUMIn hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitiEPSS 0.1%