Falhas do tipo CWE-252

130 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2026-106436MEDIUMApplication denial of service and data truncation via unchecked BSON append failures in MongoDB PHP DriverEPSS 0.3%CVE-2020-8934MEDIUMSite Kit by Google plugin for WordPressEPSS 0.2%CVE-2023-26591LOWUnchecked return value in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potenEPSS 0.2%CVE-2022-3108MEDIUMAn issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check EPSS 0.2%CVE-2023-47480HIGHAn issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.EPSS 0.2%CVE-2023-40067MEDIUMUnchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege viEPSS 0.2%CVE-2026-85649HIGH(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root uEPSS 0.2%CVE-2026-21492MEDIUMiccDEV ToneMap Writer has NULL Pointer Member CallEPSS 0.2%CVE-2024-39492HIGHmailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdownEPSS 0.2%CVE-2026-90648HIGHwasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fliEPSS 0.2%CVE-2026-21498MEDIUMNULL Pointer Dereference in iccDEV XML Calculator ParserEPSS 0.2%CVE-2026-21502MEDIUMNULL Pointer Dereference in iccDEV XML Tag ParserEPSS 0.2%CVE-2026-21497MEDIUMNULL Pointer Dereference in iccDEV Unknown Tag ParserEPSS 0.2%CVE-2026-21496MEDIUMNULL Pointer Dereference in iccDEV Signature ParserEPSS 0.2%CVE-2023-29243MEDIUMUnchecked return value in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow a priviledgeEPSS 0.2%CVE-2023-4162MEDIUMSegmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0EPSS 0.2%CVE-2026-86141LOWxmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculateEPSS 0.2%CVE-2026-0421HIGHA potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in EPSS 0.2%CVE-2026-78699HIGHrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresEPSS 0.2%CVE-2022-46897MEDIUMAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a meEPSS 0.2%