Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2021-31417MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An EPSS 0.4%CVE-2026-4715CRITICALUninitialized memory in the Graphics: Canvas2D componentEPSS 0.4%CVE-2021-31419MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An EPSS 0.4%CVE-2026-70459MEDIUMrsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List EntryEPSS 0.4%CVE-2026-91946HIGHFreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphicsEPSS 0.4%CVE-2021-3545—An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includiEPSS 0.4%CVE-2026-85089HIGHFreeRDP before 3.31.0 Information Disclosure via uninitialized heap memoryEPSS 0.4%CVE-2026-79285MEDIUMUninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data EPSS 0.4%CVE-2026-79229MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tEPSS 0.4%CVE-2026-79270MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a cEPSS 0.4%CVE-2026-4716CRITICALIncorrect boundary conditions, uninitialized memory in the JavaScript Engine componentEPSS 0.4%CVE-2026-50690MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-70290MEDIUMWin32k Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-49801MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-40422MEDIUMWindows File Explorer Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-50455MEDIUMUniversal Plug and Play (upnp.dll) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-54997MEDIUMWindows SMB Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-6749HIGHInformation disclosure due to uninitialized memory in the Graphics: Canvas2D componentEPSS 0.4%CVE-2026-66034HIGHlibssh2 Heap Out-of-Bounds Read via publickey subsystemEPSS 0.4%CVE-2026-78969MEDIUMUninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crEPSS 0.4%