Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2026-69358HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-53759HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-35326MEDIUMWindows CDP User Components Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-59204MEDIUMWindows Management Services Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-23314HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.5%CVE-2025-15281HIGHwordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memoryEPSS 0.5%CVE-2021-21781MEDIUMAn information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.1EPSS 0.5%CVE-2026-47247HIGHlibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane AllocationEPSS 0.5%CVE-2026-34543HIGHOpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)EPSS 0.5%CVE-2024-29745MEDIUMthere is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional exeEPSS 0.5%KEVCVE-2025-1942CRITICALDisclosure of uninitialized memory when .toUpperCase() causes string to get longerEPSS 0.5%CVE-2026-55949HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-9640MEDIUMSamba: vfs_streams_xattr uninitialized memory write possibleEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2024-36454MEDIUMUse of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 aEPSS 0.5%CVE-2026-68873MEDIUMWindows Program Compatibility Assistant Service Information Disclosure VulnerabilityEPSS 0.5%CVE-2021-31423MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An EPSS 0.4%CVE-2026-20962MEDIUMDynamic Root of Trust for Measurement (DRTM) Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-21959HIGHnetfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()EPSS 0.4%CVE-2021-31418MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An EPSS 0.4%