Falhas do tipo CWE-252

130 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2026-67409HIGHRabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoSEPSS 0.4%CVE-2026-22255HIGHiccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cppEPSS 0.4%CVE-2025-62789MEDIUMWazuh vulnerable to NULL pointer dereference in fim_alert line 712EPSS 0.4%CVE-2025-62790MEDIUMWazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_stateEPSS 0.4%CVE-2026-28691HIGHImageMagick has an uninitialized pointer dereference in JBIG decoderEPSS 0.4%CVE-2026-19534HIGHundici vulnerable to Denial of Service via unrequested WebSocket subprotocolEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2025-64169MEDIUMWazuh NULL pointer dereference in fim_alert line 666EPSS 0.4%CVE-2026-22047HIGHiccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cppEPSS 0.4%CVE-2025-0518MEDIUMUnchecked sscanf return value which leads to memory data leakEPSS 0.4%CVE-2026-34065HIGHnimiq-primitives: Node crash due to missing interlink validation in election macro block proposalsEPSS 0.4%CVE-2025-25724MEDIUMlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service oEPSS 0.4%CVE-2026-47245MEDIUMMyBB: Buddy list corruptionEPSS 0.4%CVE-2026-114408HIGHNULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is fullEPSS 0.4%CVE-2026-86739LOWSnipe-IT before 8.7.0 Acceptance Finalization Without Stored EvidenceEPSS 0.4%CVE-2026-77641MEDIUMtor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_froEPSS 0.4%CVE-2025-54571MEDIUMModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code DisclosureEPSS 0.3%CVE-2025-61935HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2026-18397CRITICALSConnect: Native Host Unauthenticated Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-62909HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.3%