Falhas do tipo CWE-252

114 resultados

Retorno de função não verificado

O desenvolvedor chama uma função que pode falhar (retornando erro ou null), mas não verifica o resultado antes de usá-lo. O programa segue adiante assumindo sucesso, causando comportamento indefinido ou falha em cascata quando o retorno indicava problema.

Exemplo

Um código abre um arquivo com fopen() sem verificar se retornou NULL. Na linha seguinte, tenta ler do ponteiro inválido, causando crash ou comportamento imprevisível. Ou uma função de criptografia falha silenciosamente, e o código usa dados não-criptografados pensando que estão protegidos.

Como mitigar

Sempre verificar o retorno de funções críticas (alocação de memória, I/O, criptografia, validação). Use if/else, try-catch ou assertions conforme o padrão da linguagem. Ative avisos do compilador para funções marcadas como 'warn_unused_result'.

CVE-2023-4162MEDIUMSegmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0EPSS 0.2%CVE-2026-0421HIGHA potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in EPSS 0.2%CVE-2022-46897MEDIUMAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a meEPSS 0.2%CVE-2023-50359LOWQTS, QuTS heroEPSS 0.2%CVE-2022-31225LOWDell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this EPSS 0.2%CVE-2026-90648HIGHwasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fliEPSS 0.1%CVE-2026-71180HIGHDell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with EPSS 0.1%CVE-2026-86141LOWxmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculateEPSS 0.1%CVE-2026-35344LOWuutils coreutils dd Silent Data Corruption via Unconditional Truncation Error SuppressionEPSS 0.1%CVE-2025-29938HIGHAn unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory addressEPSS 0.1%CVE-2026-78699HIGHrename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresEPSS 0.1%CVE-2026-46521MEDIUMImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionEPSS 0.1%CVE-2025-0028HIGHAn unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary addressEPSS 0.1%CVE-2026-20793MEDIUMUnchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a dEPSS 0.1%