Fallos del tipo CWE-908

345 resultados

Uso de recurso não inicializado

O código utiliza uma variável, buffer, ponteiro ou outro recurso sem atribuir um valor inicial válido. Isso causa comportamento imprevisível: o programa lê lixo de memória ou executa operações com dados aleatórios, podendo levar a falhas, vazamento de informação ou execução de código arbitrário.

Ejemplo

Um desenvolvedor declara um array local sem zerá-lo e o passa diretamente para uma função criptográfica; a função processa dados lixo da stack anterior, compromentendo a segurança da operação criptográfica. Ou um ponteiro é usado antes de ser alocado, causando acesso a endereço de memória inválido.

Cómo mitigar

Inicialize sempre variáveis no ponto de declaração (em C/C++: use memset, calloc ou atribua valores válidos; em linguagens gerenciadas, confie no runtime). Use analisadores estáticos (como Clang Static Analyzer ou Coverity) para detectar leitura sem inicialização; implemente code review obrigatório para declarações de recursos.

CVE-2026-69672MEDIUMWindows DNS Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-69770MEDIUMWindows Spaceport.sys Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-26175MEDIUMWindows Boot Manager Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-78965MEDIUMUninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted EPSS 0.4%CVE-2026-42969MEDIUMWindows Push Notification Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-72945MEDIUMWindows Task Scheduler Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-59137MEDIUMWindows Event Logging Service Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62709MEDIUMWindows GDI+ Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-62740MEDIUMWindows Imaging Component Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81391MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-81958MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-78977MEDIUMUninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insEPSS 0.4%CVE-2025-27796MEDIUMReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory iEPSS 0.4%CVE-2024-13164HIGHAn uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a locaEPSS 0.4%CVE-2024-8654MEDIUMMongoDB Server may access non-initialized region of memory leading to unexpected behaviourEPSS 0.4%CVE-2026-59136MEDIUMMicrosoft COM for Windows Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-3862MEDIUMThe MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. ThEPSS 0.4%CVE-2026-70317MEDIUMMicrosoft Office Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-3299HIGHOut-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the SLDDRW and SLDPRT file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.4%CVE-2025-59964HIGHJunos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restartEPSS 0.4%