Falhas do tipo CWE-252

130 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2023-24825HIGHRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markEPSS 1.0%CVE-2026-56388CRITICALApache bRPC: Out-of-Bounds Write in Redis Command ParserEPSS 1.0%CVE-2021-37625HIGHIncorrect Check of Function Return Value in SkytableEPSS 0.9%CVE-2021-34585HIGHCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)EPSS 0.9%CVE-2023-44322LOWA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.9%CVE-2022-38936HIGHAn issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.EPSS 0.9%CVE-2025-55146MEDIUMAn unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforEPSS 0.8%CVE-2024-37039MEDIUMCWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially craEPSS 0.8%CVE-2026-110353HIGHHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncateEPSS 0.7%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.7%CVE-2023-3247LOWMissing error check and insufficient random bytes in HTTP Digest authentication for SOAPEPSS 0.7%CVE-2026-22861HIGHiccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.7%CVE-2023-44182HIGHJunos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operationsEPSS 0.7%CVE-2026-121639CRITICALWatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of ServiceEPSS 0.7%CVE-2026-40092HIGHnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTEPSS 0.6%CVE-2025-58903LOWAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticatEPSS 0.6%CVE-2023-25733HIGHThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.EPSS 0.6%CVE-2022-43763HIGHLack of checking preconditions in APROL EPSS 0.6%CVE-2022-43765HIGHDoS in APROLs Tbase serverEPSS 0.6%CVE-2024-42491MEDIUMA malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is usedEPSS 0.6%